44e46aaaf521aae6dfaabaf292384d92ece3c68de3ec2f384561a1e139eee5f0

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mps_installer_old.exe
Size

10.7MB
MD5

5b75c914444b10782aa00da616bd391a
SHA1

26e7e0707b6cf44d179934c9eb035faf9ce1b6d4
SHA256

44e46aaaf521aae6dfaabaf292384d92ece3c68de3ec2f384561a1e139eee5f0
SHA512

9623e3ed47a8afcf8d2e7f99bb3dbb952dfa187e98cc7a99a2815e42dc0e5a9901a1a6ef95e575368f63495e8c018384e5b4cefd099a6d39425c98b954282ee7
SSDEEP

196608:3KFRZeq/yoHpHH2W1zln/LXjpCHOVecnkdKLlfjJTj4P39xipzy/m4iK:30/T/yqHH2Wj/LkHgJ5v/q/ipzydiK

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2040	Mps_installer_old.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	Mps_installer_old.exe

C:\Users\Admin\AppData\Local\Temp\Mps_installer_old.exe
"C:\Users\Admin\AppData\Local\Temp\Mps_installer_old.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst70.tmp\nsDialogs.dll

Filesize
9KB

MD5
eac1c3707970fe7c71b2d760c34763fa

SHA1
f275e659ad7798994361f6ccb1481050aba30ff8

SHA256
062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3

SHA512
3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09

Download Submit