31d4c31887cbfa5fb327280571e885c0fd3ab244f5b3bc0fcbe0d7b23e931954

Analysis

max time kernel
91s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2023, 20:02

Target

GNS3-2.2.38-all-in-one-regular.exe
Size

95.0MB
MD5

4f220cf8b0cb61b07115383eea5c83ee
SHA1

5c2ba6f785a7c617ac9fa6bcfef16b58a7d23dd6
SHA256

31d4c31887cbfa5fb327280571e885c0fd3ab244f5b3bc0fcbe0d7b23e931954
SHA512

fba3689f7b5b15c21af66307640321c8a46da53e54d44861b6e8920ca0b6e4ca56f25ca95562195a9d5b5ab1b14f8ad62f13586234c094f43fd0da442f44c315
SSDEEP

1572864:6qofJW1Z/lSA23bbwSg0UQoHIhIAGv3hpsk/kOLCkwirZzuiEsMuxc/GyKdznYGA:6Lf8PtStbgIVWh6bMCkzZzuiEssGHYWG

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
564	GNS3-2.2.38-all-in-one-regular.exe
564	GNS3-2.2.38-all-in-one-regular.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\GNS3-2.2.38-all-in-one-regular.exe
"C:\Users\Admin\AppData\Local\Temp\GNS3-2.2.38-all-in-one-regular.exe"
1⤵
- Loads dropped DLL
PID:564

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsp3971.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp3971.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit