7892a94583aa182aa043b62ee3053363521df69754afb3eab0f8d02b64ebb6c6

Analysis

max time kernel
249s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MPRSetup.exe
Size

1.5MB
MD5

457dc8767056afea75afd1bee381f7ff
SHA1

9cd4c003183aa60de8bb69d69cf94251f7e0675d
SHA256

256a2f69820251b0b9b8de53d1ad9991e6e934e6f57ee8c0eebc97e6cacfa11c
SHA512

e74b149dd44f0f46aaafba73e244a2f47d0d2d2ca7a7cc0ddf614cbc0f48b784312271d1e881fe38227cc66c4387c92963aaaa020b01fcbcaae0b9de50525066
SSDEEP

24576:s+PUC8sMe1oSeplEvSh7PDM/7nD3x89mGKUszZlz4LMbU4XIhHqWaW5:sEUYe3WShEx89m75XUMbR4qQ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
652	MPRSetup.exe
652	MPRSetup.exe
652	MPRSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
652	MPRSetup.exe

C:\Users\Admin\AppData\Local\Temp\MPRSetup.exe
"C:\Users\Admin\AppData\Local\Temp\MPRSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsk23F8.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsk23F8.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
\Users\Admin\AppData\Local\Temp\nsk23F8.tmp\UAC.dll

Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
memory/652-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download