775e1297d7abf73894ef8d0733e5388f6c849ff96852dac42bfb20081c3aa75b

Analysis

max time kernel
130s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-05-2023 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SIM_Installer.exe
Size

171.1MB
MD5

470b9415d91a91bc042e763dc97bf2b6
SHA1

1bfe8c11858cc618fcded0a589dc7c55216392f9
SHA256

1f1cbcae937f9926d22aa65a94695709a1f5a1dc189f339725d7f5822a3a707d
SHA512

cfd26398f596fb4d52fef4cf875e56955d0c4d7eb230f02797a13eb43d8a475bed4c39769be9aa9eb91277a6f662784961c992b0a833d5ec0d7db2d8ef0d43cc
SSDEEP

3145728:D9uA5ffl4k3hDpa5ay79TH3TyRL62JWiyNm0AHdeUovwrwrQd6f0BS:D9uAlfl4kxDpa0y79b3mRu2sQ0kYpwrs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1284	SIM_Installer.exe
1284	SIM_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	SIM_Installer.exe

C:\Users\Admin\AppData\Local\Temp\SIM_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\SIM_Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd4194.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\nsd4194.tmp\nsDialogs.dll

Filesize
9KB

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit