52ad5d278b1e465a638e3435b500d1e48bc5c12228cfc485b602e3b037ab0f26

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Breakaway Audio Enhancer 1.30.02/breakaway_setup_1.30.02.exe
Size

3.1MB
MD5

ae70c17f344b583d3e8d6f687c836288
SHA1

7a618d7add0e6025b15e565b857a764785436e5a
SHA256

744ac61b8babd0a62ea09d647b065fde7e234d640404d51f2b0262f92459e55f
SHA512

ded4e72355b4685ff962a346fb452695f47e9934fe0d6a80aaf2865345120904dc6508d346f83a21169408d977439c84ddc02ce4a2f8dc9ce1de784906ba3953
SSDEEP

98304:6lpUCA09p7WU7uKG7f7jFIh0So3vtZ3hXd:6XdhnWRf7ZKBo3vtV

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1516	breakaway_setup_1.30.02.exe
1516	breakaway_setup_1.30.02.exe
1516	breakaway_setup_1.30.02.exe
1516	breakaway_setup_1.30.02.exe
1516	breakaway_setup_1.30.02.exe
1516	breakaway_setup_1.30.02.exe
1516	breakaway_setup_1.30.02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	breakaway_setup_1.30.02.exe

C:\Users\Admin\AppData\Local\Temp\Breakaway Audio Enhancer 1.30.02\breakaway_setup_1.30.02.exe
"C:\Users\Admin\AppData\Local\Temp\Breakaway Audio Enhancer 1.30.02\breakaway_setup_1.30.02.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\System.dll

Filesize
10KB

MD5
82f7926fd7d12e3eb8ed7b5232bcf956

SHA1
6065fc921b742cc86c77ce2533fc1d17359eb45e

SHA256
604b5e75f43ffae8f172018cdd8f136392d9c52ae0c100d27ef537bb2dfb3984

SHA512
b31a63ebbda8f147c32d8336c5ecde8c5261ad5526b01926d7cd74b7a9a1348da56e180e53d20e1e300daca76f9511f24d6e695550b705b7650c239e5b6e76c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\UAC.dll

Filesize
14KB

MD5
b7d7324f2128531c9777d837516b65a6

SHA1
e15e44fc7c907329e1cd3985e8666b4332f4fa48

SHA256
530dc2b26366fc86072487438317a5723a10ff8b38522f9e813df19146a31033

SHA512
829fc241cd377de094faf80bb38828c3d877170ca4a3fd85810bc911d2ce38941f8067ef681c21d8bbc04be8a99a3d32b3aec51ae7b32d3a89e5a9d9597ed8d5

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9B56.tmp\nsDialogs.dll

Filesize
8KB

MD5
f42b19bd20c82eabcfe14273499e7664

SHA1
99310fe91a2e2fbe720761b5625e1f83afeee0db

SHA256
c99f30f5e2dfd948b7da2219bc5a0a73836a70e2486272b42c3ca45710b0316a

SHA512
c6867ee68b3099a9b03aba7367ed6e55576f874eccab71fbebbc9c3cb01f20e616615e8080c2a379b7e7da1abe6cd776f862f8c9ad4dce38d2fa79b48fa38e49

Download Submit