fda9847dd1d543d09942f2b9a6ac89c86269e7aefc623aa59ed450738e39d687

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e2112c0a38d07c4379a9bf1dc274be4.exe
Size

1.6MB
MD5

0e2112c0a38d07c4379a9bf1dc274be4
SHA1

e839253540aa57b44bc761b3200b43d05b41f510
SHA256

fda9847dd1d543d09942f2b9a6ac89c86269e7aefc623aa59ed450738e39d687
SHA512

98a784cebd8fa8345ae4e5bd8cf3d67d217e7e9f6f805f415dea6264f93a0062995111cb147132a397fb27d8514ce2046aac9077c548b5791dfc0facae5d4411
SSDEEP

24576:etfm+N0ZBqyEpB4jZtXCoRdYK3maaog+/qDsI258+WteGFKHlawM+/t+vHVmt:Uo+qXFOaaP+S1AygGFKDMilt

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2024	0e2112c0a38d07c4379a9bf1dc274be4.exe
2024	0e2112c0a38d07c4379a9bf1dc274be4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	0e2112c0a38d07c4379a9bf1dc274be4.exe

C:\Users\Admin\AppData\Local\Temp\0e2112c0a38d07c4379a9bf1dc274be4.exe
"C:\Users\Admin\AppData\Local\Temp\0e2112c0a38d07c4379a9bf1dc274be4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso207E.tmp\ioSpecial.ini

Filesize
660B

MD5
cb16589e4f20402b72996552d317da3f

SHA1
ac81bd44199a2805a724c3d7b560d7c0b6016bb0

SHA256
35622dc44e4fecf15d14c4aea1e8adf04eba2f13fcc2fea9242377de0b2edbe8

SHA512
11db3e4fab650bfa34fa7080ff362e692992eb95be2f5c969a0888d30e58ff9ff22b53e69b0acead19e63183f273760f2c348b3a9541b6bd7c5fed785da08ada

Download Submit
\Users\Admin\AppData\Local\Temp\nso207E.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nso207E.tmp\InstallOptions.dll

Filesize
14KB

MD5
107737e3282fefd85684f2fa3df6d1c3

SHA1
3befbcae116a644ae28cebdc1d7dfe6be5c8ca5f

SHA256
21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0

SHA512
439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4

Download Submit