fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474

Analysis

max time kernel
99s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2023, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe
Size 1.2MB
Sample230420-2c5mraef2t
SHA256 fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474
MD5 06f238c37374d3365aa5cd4d30fd1682
SHA1 3aaea9a136961aaf7c978cb783033bea75c0f5ff
SHA512 6da9b68858809c68d9eb82b5baa05e25856ce71600a52fceb8a8fd96fadccd46952d62144a2a09807d3968de5446adf106bb6e3358c1f879ca5d5a68c30a8872
SSDEEP 24576:4CRaJRpaeUP591+WZ/leKH/sufCWCT+mPZdhX6BJfoVCIqE:4a2oz57+ikIEufCtTTJ6BuLv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2796	fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe
"C:\Users\Admin\AppData\Local\Temp\fba07a3ee42fb316e79526fe3b982970cea22a094b43cd5162dbe022070e9474.exe"
1⤵
- Loads dropped DLL
PID:2796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh7390.tmp\InstallOptions.dll
Size 14KB
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsh7390.tmp\ioSpecial.ini
Size 623B
SHA256 6be2598ec091c291efd5d08dae3089738d501642e645129fd3c02a6847368f33
MD5 2dd5e1a81e1ebda6d3c1998f09e255f9
SHA1 dc4434534ab460937e28b5313c9ff795e40f9216
SHA512 2d928ea1d7dada5bf2da4ced167c3cc937d15737643ddc209a3df1fae59bd409c3ab71e4b1a75546d43a508141ac7089d0f57d3c53974270576e30217dec4298
MD5 SHA1 SHA512