6a76e370cc3975f79341ab9f418293c2de6783c17fb920d725547a5fe5cddc5e

Analysis

max time kernel
25s
max time network
84s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/06/2023, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_ow.exe
Size

96.7MB
MD5

34cdc8be68cc7e1a00aeef6ba3cc1e63
SHA1

31120a6f8d555f55f3684ebe32bff30201bdbec3
SHA256

a8ff593cd143adf7bf29fa9f782d81e05f886b3522158656ef4aba9a173e58f7
SHA512

7e5f28806c05377df2f7948d06a7ffafaa5e884fd1059cfa7bb4fe79a2507a5b987fbc98d1db638632e055ad35a438f5ac384d5bf0edf7b3bb372c7992aacdc0
SSDEEP

3145728:/J9FPNHiP2pfFyGUmaXkkQVr+GB9IB2eviQ:/J9FPZ5X5aUd3CXiQ

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1856	setup_ow.exe
1856	setup_ow.exe
1856	setup_ow.exe
1856	setup_ow.exe
1856	setup_ow.exe
1856	setup_ow.exe
1856	setup_ow.exe
1856	setup_ow.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	WinHttp.WinHttpRequest.5.1

C:\Users\Admin\AppData\Local\Temp\setup_ow.exe
"C:\Users\Admin\AppData\Local\Temp\setup_ow.exe"
1⤵
- Loads dropped DLL
PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst89DA.tmp\NsToolsPlugin.dll

Filesize
125KB

MD5
d89e8a39c241ec060d6dd827e73ea73d

SHA1
4c5efb1c577a2cb8fc05a171837c26ae38871724

SHA256
a7ce5574eb852f2d89feb2d3eb2755c745a8b7ccee7bd62d5a06bd9a6b15278d

SHA512
d43c8db6820a7850f2e877748ace8fea87d787bae6427068526cdc208a1b4587116dbb95eec5f11771d04b24b75698a25ca40ce2b8241efa9fb2218a6fd012fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst89DA.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst89DA.tmp\nsNiuniuSkin.dll

Filesize
904KB

MD5
00b5a327b44faaaf7fc373176cd454ed

SHA1
e58ea8e7de259f5d577c01eeac28cc8f72b65094

SHA256
f125ed6489f16f1681ea92e30f6670f72e0951cd7948df9a043e04ee512ccbeb

SHA512
a7c5955652e1dd6f33e6596f0861a2127e4a259ae7abd256a44b3ffc36c1861e29fe3e9a2b60aa5a0230430411c737ef2b2e9170e4f0f42f737039451326340a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst89DA.tmp\skin.zip

Filesize
173KB

MD5
b5733f1cb081d8e479cc226ef4c28d3f

SHA1
e31459d0933bc6eb73fcb0a33744a7f8a19f1b9e

SHA256
4a41eebbf297726e9fd68fa69c846c010684390281e89c992e739fa9f46cd348

SHA512
5ff7ed5058b4662bdb762e61683a5b22ca0756dbd129abb5daba723c3e2025a26e357ec598acf52fdd4d6a0d8d6650e1d2089a23366d54fa1e8aea87aa585652

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\NsToolsPlugin.dll

Filesize
125KB

MD5
d89e8a39c241ec060d6dd827e73ea73d

SHA1
4c5efb1c577a2cb8fc05a171837c26ae38871724

SHA256
a7ce5574eb852f2d89feb2d3eb2755c745a8b7ccee7bd62d5a06bd9a6b15278d

SHA512
d43c8db6820a7850f2e877748ace8fea87d787bae6427068526cdc208a1b4587116dbb95eec5f11771d04b24b75698a25ca40ce2b8241efa9fb2218a6fd012fa

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\NsToolsPlugin.dll

Filesize
125KB

MD5
d89e8a39c241ec060d6dd827e73ea73d

SHA1
4c5efb1c577a2cb8fc05a171837c26ae38871724

SHA256
a7ce5574eb852f2d89feb2d3eb2755c745a8b7ccee7bd62d5a06bd9a6b15278d

SHA512
d43c8db6820a7850f2e877748ace8fea87d787bae6427068526cdc208a1b4587116dbb95eec5f11771d04b24b75698a25ca40ce2b8241efa9fb2218a6fd012fa

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\NsToolsPlugin.dll

Filesize
125KB

MD5
d89e8a39c241ec060d6dd827e73ea73d

SHA1
4c5efb1c577a2cb8fc05a171837c26ae38871724

SHA256
a7ce5574eb852f2d89feb2d3eb2755c745a8b7ccee7bd62d5a06bd9a6b15278d

SHA512
d43c8db6820a7850f2e877748ace8fea87d787bae6427068526cdc208a1b4587116dbb95eec5f11771d04b24b75698a25ca40ce2b8241efa9fb2218a6fd012fa

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\NsToolsPlugin.dll

Filesize
125KB

MD5
d89e8a39c241ec060d6dd827e73ea73d

SHA1
4c5efb1c577a2cb8fc05a171837c26ae38871724

SHA256
a7ce5574eb852f2d89feb2d3eb2755c745a8b7ccee7bd62d5a06bd9a6b15278d

SHA512
d43c8db6820a7850f2e877748ace8fea87d787bae6427068526cdc208a1b4587116dbb95eec5f11771d04b24b75698a25ca40ce2b8241efa9fb2218a6fd012fa

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\NsToolsPlugin.dll

Filesize
125KB

MD5
d89e8a39c241ec060d6dd827e73ea73d

SHA1
4c5efb1c577a2cb8fc05a171837c26ae38871724

SHA256
a7ce5574eb852f2d89feb2d3eb2755c745a8b7ccee7bd62d5a06bd9a6b15278d

SHA512
d43c8db6820a7850f2e877748ace8fea87d787bae6427068526cdc208a1b4587116dbb95eec5f11771d04b24b75698a25ca40ce2b8241efa9fb2218a6fd012fa

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst89DA.tmp\nsNiuniuSkin.dll

Filesize
904KB

MD5
00b5a327b44faaaf7fc373176cd454ed

SHA1
e58ea8e7de259f5d577c01eeac28cc8f72b65094

SHA256
f125ed6489f16f1681ea92e30f6670f72e0951cd7948df9a043e04ee512ccbeb

SHA512
a7c5955652e1dd6f33e6596f0861a2127e4a259ae7abd256a44b3ffc36c1861e29fe3e9a2b60aa5a0230430411c737ef2b2e9170e4f0f42f737039451326340a

Download Submit