db7ebfcc9f1c6819922f5f919d2549a98a1a6bd84bb17e179694aaf5399e333c

Analysis

max time kernel
124s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abwsx1.exe
Size

2.9MB
MD5

6ce34a02901961627352d5ed070dbc5c
SHA1

d8721b647449525a25d114540eb955ab588498d6
SHA256

db7ebfcc9f1c6819922f5f919d2549a98a1a6bd84bb17e179694aaf5399e333c
SHA512

22b46a081e846c0a84873c3072847572af6ffd29e0585ccfeedcf3c12699ce38486d962f7d6aaa9f316e47a008e3011dc09fbe4547c24c2d614e5140195e0794
SSDEEP

49152:8gIfvhH25VZv1ZFKHt/7j9Qgbr7H4yjzi8I34C51sQUTaTu7nGsdJPUd:xIfvhH0Vz+3QEH4Ezi8I3Lrs/TaTuz3U

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe
1660	abwsx1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1660	abwsx1.exe

C:\Users\Admin\AppData\Local\Temp\abwsx1.exe
"C:\Users\Admin\AppData\Local\Temp\abwsx1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst5351.tmp\AccessControl.dll

Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5351.tmp\service.dll

Filesize
4KB

MD5
9fa60fa871a328d5169767832b5c460b

SHA1
cfa29d328c1b9c496d5cfba39f57347b879f9340

SHA256
1b1f4eee4b447735857b4e8aa8546632ec32e8faf5ba451860366872df56aa34

SHA512
0cd51c4a68f7cfaa35cbb3ec15f4228654d8d0ebc6ecb0e350927f296cb48127db4e97a1fda8c9269d7452884a6f31fbff2fe4f894bf0ecf8cb614886effe70d

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\AccessControl.dll

Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\AccessControl.dll

Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\AccessControl.dll

Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\AccessControl.dll

Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\AccessControl.dll

Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\System.dll

Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\service.dll

Filesize
4KB

MD5
9fa60fa871a328d5169767832b5c460b

SHA1
cfa29d328c1b9c496d5cfba39f57347b879f9340

SHA256
1b1f4eee4b447735857b4e8aa8546632ec32e8faf5ba451860366872df56aa34

SHA512
0cd51c4a68f7cfaa35cbb3ec15f4228654d8d0ebc6ecb0e350927f296cb48127db4e97a1fda8c9269d7452884a6f31fbff2fe4f894bf0ecf8cb614886effe70d

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\service.dll

Filesize
4KB

MD5
9fa60fa871a328d5169767832b5c460b

SHA1
cfa29d328c1b9c496d5cfba39f57347b879f9340

SHA256
1b1f4eee4b447735857b4e8aa8546632ec32e8faf5ba451860366872df56aa34

SHA512
0cd51c4a68f7cfaa35cbb3ec15f4228654d8d0ebc6ecb0e350927f296cb48127db4e97a1fda8c9269d7452884a6f31fbff2fe4f894bf0ecf8cb614886effe70d

Download Submit
\Users\Admin\AppData\Local\Temp\nst5351.tmp\service.dll

Filesize
4KB

MD5
9fa60fa871a328d5169767832b5c460b

SHA1
cfa29d328c1b9c496d5cfba39f57347b879f9340

SHA256
1b1f4eee4b447735857b4e8aa8546632ec32e8faf5ba451860366872df56aa34

SHA512
0cd51c4a68f7cfaa35cbb3ec15f4228654d8d0ebc6ecb0e350927f296cb48127db4e97a1fda8c9269d7452884a6f31fbff2fe4f894bf0ecf8cb614886effe70d

Download Submit