2fb92cd068f5f815efed191c0f238889ef0fbe015e11c7449ee5d083c0e133d7

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-04-2023 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

numuki-browser-web-setup.exe
Size

645KB
MD5

d5597d608723bc160bdef0be231c4df0
SHA1

2f1b489918025bf7f7e6e5e076aebb0d3e3c17fd
SHA256

2fb92cd068f5f815efed191c0f238889ef0fbe015e11c7449ee5d083c0e133d7
SHA512

d841cef9442422781e151eda8d003412ba8d2dd7b43558a45134eefc44520fd7eb1b6c0290ff81bd5f9ac787418a9baf46846ed8951ef582105d0351196ad8e6
SSDEEP

12288:Jgb1A7RKaDPNKT1zH3ptaR1sDfOQSvJqFZ6zMg1pPk:Jgb1iMaDu173pG1szLSvJwynzPk

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 16 IoCs

Processes:

numuki-browser-web-setup.exe

pid	process
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1236	numuki-browser-web-setup.exe
1220
1220
1220
1220

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

numuki-browser-web-setup.exe

pid process

1236 numuki-browser-web-setup.exe
1236 numuki-browser-web-setup.exe
1236 numuki-browser-web-setup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

numuki-browser-web-setup.exe

description pid process

Token: SeSecurityPrivilege 1236 numuki-browser-web-setup.exe

description	pid	process
Token: SeSecurityPrivilege	1236	numuki-browser-web-setup.exe

C:\Users\Admin\AppData\Local\Temp\numuki-browser-web-setup.exe
"C:\Users\Admin\AppData\Local\Temp\numuki-browser-web-setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
"C:\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe"
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
53.6MB

MD5
f54694f567d748d973fbe39b6c5fdb7b

SHA1
024a41c0c54793e2410222f4f631138333ebc932

SHA256
c5e3337a834e0b76fed3e084a590dd23ddf5ddc1a070b6157b05c6a47c45e975

SHA512
df14b58291450a86b80ec467ae3c05c9175703800e26760e94487e2f185e50a49c3de808e257ea574631cfaae5cae5363b8fbd0cdf8981ca07cb8ec27a1749fc

Download Submit
C:\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
704KB

MD5
44969fc978e88cbcfd20bf7288d5b884

SHA1
1feffa4f54b9dc81bc669cbd3102ea075b0fe029

SHA256
bf08f27b1fde52d276085ae18924bf07c528a8e060ca4dd9382aeb6883ea4699

SHA512
82d263753cc8fbb5e6778edbb9e302a6d323842fe7f23d443f784c6e7269a33ad3f133c6c5b994e77c2ab57091d57d18e72b6f57230171dd9eb8b4609ce1ca5f

Download Submit
C:\Users\Admin\AppData\Local\Programs\numuki-browser\ffmpeg.dll
Filesize
640KB

MD5
27754fcbdda864d1fa5d206a00ad89c3

SHA1
819370b79c0941c1d681cb48e21166930d5ee023

SHA256
a085aacd706bbd522704a9a00dbc7ba61246dace2d3944a1b2f5c32cb53f6a8d

SHA512
c4ad6df8678ae136889ec500b07d85fe9ea20d07bca1071d547a3ea2a398fbae6a5f606b53dd30f347f7456ef786c694aa83aaccfe1a8fe602e3909f6c7ee0ee

Download Submit
C:\Users\Admin\AppData\Local\Programs\numuki-browser\icudtl.dat
Filesize
192KB

MD5
c7d44dfe9652f8b04721dc8a93458536

SHA1
bc09e4f196142970fbad4341223d4f054ea32220

SHA256
ed0eecdcab642ea7dc5f12e866eb56cb9338941ce0eb45001c77c1122a216199

SHA512
afef4b527d64b74d1019ecceb4a3fabc2f216a0128aa7b5fdde51e743fee3c42b9cca097a06192740bf2514d3944f95996abafa132c4aa7c437f111af3fcafe7

Download Submit
C:\Users\Admin\AppData\Local\Programs\numuki-browser\v8_context_snapshot.bin
Filesize
168KB

MD5
ae1c494f86526c45da8f1446159080d9

SHA1
7bb12b3c1b4c9c344afd265b53370d90582069e5

SHA256
59170b40e9acae9f4a524f6f5e690adae82b8ae2f90549d8e3339f8567cfadbc

SHA512
fd7aee998b0aa9d2a57a392f8051cb00bfb24a9395395b618f3d6d8edefeffdd9eed0449ed674cc2a03e8bfe5dd1f2f24d7ca9e343059f913b0b29ebd8f06a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstFD64.tmp\StdUtils.dll
Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstFD64.tmp\WinShell.dll
Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstFD64.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstFD64.tmp\package.7z
Filesize
84.7MB

MD5
f1ddf8e2b1188fd1f8897eee3404e473

SHA1
68e1f81ae4e52ff061f5a3ffce621799873161c5

SHA256
979f6560461d16073dd728dc851337bb8198259523ca853dcab1a6b6627d245c

SHA512
bf0196799438ddcef78ae1696b69a28d5afb141d57342c1d11ab80b940a3745dacfae9d0f176accb8c35fd59e189d8232cf27069e5a3b5bd4256e8c645679180

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
54.2MB

MD5
aa673a6bfa4501936297b04fb607c486

SHA1
2b83a2091771deda4d3d6a24e8aa22c5485d1033

SHA256
75e2adf7dc55ea840e17e96c066b8663d94068d530e98d1624ae0cb59c535fc1

SHA512
2b2f89698ff2e932bac7336378349ac77b9a1a38686be939005a363eedd4ad2fa59c85a08ab48fe8749e58e8f2b367fd8e715f915d8b9f75550a1c1c48d10b74

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
53.6MB

MD5
f54694f567d748d973fbe39b6c5fdb7b

SHA1
024a41c0c54793e2410222f4f631138333ebc932

SHA256
c5e3337a834e0b76fed3e084a590dd23ddf5ddc1a070b6157b05c6a47c45e975

SHA512
df14b58291450a86b80ec467ae3c05c9175703800e26760e94487e2f185e50a49c3de808e257ea574631cfaae5cae5363b8fbd0cdf8981ca07cb8ec27a1749fc

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
53.4MB

MD5
2abacfab33b58221dbe14211a2fe7d4f

SHA1
2b32a5e702a9b3b443bb72eb79f15894f6ada55f

SHA256
8028d91dc2d4ecf29d316f160ef123259e523c8353f522092de1332bb9211925

SHA512
816e6a59118eddc6c44a47d06bf3c24fbadf393c3aedc1d01c831b5c934746a7ddb15909c75ddbeb84e73d8863bd415dc4df35d7cfa590d3dcb3d3344e42edc4

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
25.5MB

MD5
9247a4e329852b3c4f7536f755cc4c02

SHA1
ebdb0c5091012c76a93c8ff2188bf5123c731f16

SHA256
6f676cc50991e129210eb7ae68c0195400bb837b5f0ab8961f977610ec4f9269

SHA512
0914287a7b8cb7ec74c0a7d79dedc349808af4d0e617f9d205f3610b7b958f182342365c7cb64e5115826f7b613187e12270e96783e109ba7fec1205346ba017

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
23.4MB

MD5
5c034c7efd89a069eeb9f4fb181f06b7

SHA1
1320c99a9d1ef9b5a7754ccb730600fd9d17b049

SHA256
b058c503fa990ed8eda010295c9b6f16e29c32d573d5c639a103badb8f716c42

SHA512
38dc6ae63bb8a1ef4c298ec12479c33e51c7cf91f9c915aa2107492508d6931370f968dfdfcb98f829ccee46c21d40763a29a5d472b6d4e94e0bde2664e45a25

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
23.5MB

MD5
97b679547c7414cd348261d986f1f746

SHA1
5216bf00ec8440f635f4734a2327ebeabe970db3

SHA256
f5d18abcd515bd18188feba164639566e01575cc74b8765d5d5574c3eb3799e4

SHA512
155ae589e176dea53a72e5b1b7f2fc1c48172ce2abb9af2697fcd4a02ecf5ead2a119242e63baf6ad71efd9ee6a763ce0b040f844133e2016945a5d6ed29ca56

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
23.4MB

MD5
5c034c7efd89a069eeb9f4fb181f06b7

SHA1
1320c99a9d1ef9b5a7754ccb730600fd9d17b049

SHA256
b058c503fa990ed8eda010295c9b6f16e29c32d573d5c639a103badb8f716c42

SHA512
38dc6ae63bb8a1ef4c298ec12479c33e51c7cf91f9c915aa2107492508d6931370f968dfdfcb98f829ccee46c21d40763a29a5d472b6d4e94e0bde2664e45a25

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\NuMuKi Browser.exe
Filesize
23.4MB

MD5
19bb97f92c54d95c7483c833340dd0ea

SHA1
6f2536ecc349930483245fb45a0a90e0c4625ee6

SHA256
d6398836fe5473651e45baae651592c318efeff60a3fd98eca2ad703e679fe30

SHA512
c2149a15ce2b35e4ee1de99efb405e14a8ee45e27ede87732fa1633bfce197bc86b1e1cdf846310ed9d7cae2d51a32464b60ddcbb9bf84b4f5a9dec5e6672132

Download Submit
\Users\Admin\AppData\Local\Programs\numuki-browser\ffmpeg.dll
Filesize
640KB

MD5
27754fcbdda864d1fa5d206a00ad89c3

SHA1
819370b79c0941c1d681cb48e21166930d5ee023

SHA256
a085aacd706bbd522704a9a00dbc7ba61246dace2d3944a1b2f5c32cb53f6a8d

SHA512
c4ad6df8678ae136889ec500b07d85fe9ea20d07bca1071d547a3ea2a398fbae6a5f606b53dd30f347f7456ef786c694aa83aaccfe1a8fe602e3909f6c7ee0ee

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\INetC.dll
Filesize
238KB

MD5
38caa11a462b16538e0a3daeb2fc0eaf

SHA1
c22a190b83f4b6dc0d6a44b98eac1a89a78de55c

SHA256
ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a

SHA512
777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\SpiderBanner.dll
Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\StdUtils.dll
Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\System.dll
Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\WinShell.dll
Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\WinShell.dll
Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nstFD64.tmp\nsis7z.dll
Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit