fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474

Analysis

max time kernel
133s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-04-2023 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe
Size

1.2MB
MD5

06f238c37374d3365aa5cd4d30fd1682
SHA1

3aaea9a136961aaf7c978cb783033bea75c0f5ff
SHA256

fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474
SHA512

6da9b68858809c68d9eb82b5baa05e25856ce71600a52fceb8a8fd96fadccd46952d62144a2a09807d3968de5446adf106bb6e3358c1f879ca5d5a68c30a8872
SSDEEP

24576:4CRaJRpaeUP591+WZ/leKH/sufCWCT+mPZdhX6BJfoVCIqE:4a2oz57+ikIEufCtTTJ6BuLv

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1228	fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe

C:\Users\Admin\AppData\Local\Temp\fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe
"C:\Users\Admin\AppData\Local\Temp\fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd35B2.tmp\ioSpecial.ini

Filesize
623B

MD5
9d42b15e6c368a53d1ee904b1af8effe

SHA1
6f71a425443fec9217287ca948da95211793ab98

SHA256
b693e7e9961d753fb7177466f81a931f11fb636e9f22041cc877e7703031c113

SHA512
46ed363b9a46878a0d0bb8cd076606d0b06734a5c8324f0b87491180e177aa3868b7af33d6d120a07e93565b20d3f87e9656ba97d4e911f3eebcd80d9dab00d4

Download Submit
\Users\Admin\AppData\Local\Temp\nsd35B2.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit