Overview

overview

7

Static

static

3

05d1a223d4...2e.exe

windows7-x64

7

05d1a223d4...2e.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 16:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    05d1a223d42318c9b283545c090d072e.exe

  • Size

    2.4MB

  • MD5

    05d1a223d42318c9b283545c090d072e

  • SHA1

    75547fa0e6618cc68ddb41590121bc351dffafb2

  • SHA256

    e671a0dab5a1ec14473c0cf14c3b3bf76fb06c8265818089931111f32b12f53f

  • SHA512

    7bf13e91ed3f54c1a4a923ae5ba5f7d52f32bf6d965310e1fe1bb02b987ee3c1f5f48e49ccbfaf57d16e873b9429f758638b3b75b390a0eb478a055173769ab0

  • SSDEEP

    49152:diqFCTEWPZ+ySZ+t49XtBm61FcE6t8fst06TUazRKorUZwMy12/cMhGx8qlC9PCE:I4CTEW9S1911+E68Et06IgghBEahhSf6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05d1a223d42318c9b283545c090d072e.exe
    "C:\Users\Admin\AppData\Local\Temp\05d1a223d42318c9b283545c090d072e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2348

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nstFBBE.tmp\ioSpecial.ini
          Filesize

          536B

          MD5

          ca29eb2134d8d2fbe1379df069d697c9

          SHA1

          1d2fdec781ac05ec2382cad64de743a2648e0613

          SHA256

          8158f53f49d2a4a2165bb22520b05a04190b030c9f12b52c1543689e3aa6cc06

          SHA512

          82737c090fe5e70d190cc2200648fdd82a799eb971b64b556ae4ff8e0692201cff62e71565d6f7211a4699cd27a87b269559be420c04afd3eace6a093330f4cc

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nstFBBE.tmp\FindProcDLL.dll
          Filesize

          25KB

          MD5

          c157cf17930e00bd87895dd36164911e

          SHA1

          5ba8e9c91202aa1b29a78336e330eba7388694bb

          SHA256

          a11591c243132f7b39122408b1927369abd71491c7525292626028a24b0b348c

          SHA512

          086758a6fcfba5b5a96136830db69fafa4aab1497df5dbe15d22d739e7a3590ec4f8bab8a0642a00abf3db4e981a75f66ed0ae6f386ad1e3f068cf2156b780e7

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nstFBBE.tmp\InstallOptions.dll
          Filesize

          14KB

          MD5

          0dc0cc7a6d9db685bf05a7e5f3ea4781

          SHA1

          5d8b6268eeec9d8d904bc9d988a4b588b392213f

          SHA256

          8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

          SHA512

          814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

          Download Submit