Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2023 06:29

General

  • Target

    foobar2000_v1.1.exe

  • Size

    3.1MB

  • MD5

    82a5c9d1e5531b11b7d2ed8cc1cc7dae

  • SHA1

    76e89edc70731c9efd2d98f59f3e272ac18944bf

  • SHA256

    1bcfccfad2403e416e09711fc695b13665b0af9eb591e3fbdc70f356706a21f9

  • SHA512

    6c5862bfc3dd86e5ee742f4f1d507e94e7f40059ea257f450fc4e9121db54370b0ccd8e9c62d8eeaa4c3bd06035b8de08ff4ee45636cd7296f8e6afece07bfeb

  • SSDEEP

    49152:hULczFeYwqvvIHbqDyJUKijOdupv5sZ4m9H5CXNw6EH6bKCSnMbzPK3RfRVY9R1E:hT5yqwkyJcMGhsiuH5CNl3Kpy4FgR1qN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\foobar2000_v1.1.exe
    "C:\Users\Admin\AppData\Local\Temp\foobar2000_v1.1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nso6A3A.tmp\System.dll

    Filesize

    11KB

    MD5

    959ea64598b9a3e494c00e8fa793be7e

    SHA1

    40f284a3b92c2f04b1038def79579d4b3d066ee0

    SHA256

    03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

    SHA512

    5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

  • \Users\Admin\AppData\Local\Temp\nso6A3A.tmp\System.dll

    Filesize

    11KB

    MD5

    959ea64598b9a3e494c00e8fa793be7e

    SHA1

    40f284a3b92c2f04b1038def79579d4b3d066ee0

    SHA256

    03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

    SHA512

    5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

  • \Users\Admin\AppData\Local\Temp\nso6A3A.tmp\System.dll

    Filesize

    11KB

    MD5

    959ea64598b9a3e494c00e8fa793be7e

    SHA1

    40f284a3b92c2f04b1038def79579d4b3d066ee0

    SHA256

    03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

    SHA512

    5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

  • \Users\Admin\AppData\Local\Temp\nso6A3A.tmp\UAC.dll

    Filesize

    13KB

    MD5

    a88baad3461d2e9928a15753b1d93fd7

    SHA1

    bb826e35264968bbc3b981d8430ac55df1e6d4a6

    SHA256

    c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af

    SHA512

    5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a

  • \Users\Admin\AppData\Local\Temp\nso6A3A.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    f7b92b78f1a00a872c8a38f40afa7d65

    SHA1

    872522498f69ad49270190c74cf3af28862057f2

    SHA256

    2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

    SHA512

    3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79