464598d1bf1ee4ac836f3314db4cee99af1afb7c832a14bff5040bc8721ca9d1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25b44ab39a0958e1da244404d471ac8e.exe
Size

15.2MB
MD5

25b44ab39a0958e1da244404d471ac8e
SHA1

c7932da8987949a23260b847d450c7b0284aa58b
SHA256

464598d1bf1ee4ac836f3314db4cee99af1afb7c832a14bff5040bc8721ca9d1
SHA512

baf3e14c750070f352a9df7d1c042839746040f6a261d12b8a2643e15a4bf905d46c459c3957d94b69dd62e82dc8f7d97722f4d4f2b45716bdcf6790cdf97c4b
SSDEEP

393216:HGhAUOhKGKjLUv360eIuFwgd2nIf3fodYJhICKGpjKy:HNhZKj0q0eIvgUn8nXIn

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2920	25b44ab39a0958e1da244404d471ac8e.exe
2920	25b44ab39a0958e1da244404d471ac8e.exe
2920	25b44ab39a0958e1da244404d471ac8e.exe
2920	25b44ab39a0958e1da244404d471ac8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	25b44ab39a0958e1da244404d471ac8e.exe

C:\Users\Admin\AppData\Local\Temp\25b44ab39a0958e1da244404d471ac8e.exe
"C:\Users\Admin\AppData\Local\Temp\25b44ab39a0958e1da244404d471ac8e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy1AF2.tmp\System.dll

Filesize
10KB

MD5
7d85b1f619a3023cc693a88f040826d2

SHA1
09f5d32f8143e7e0d9270430708db1b9fc8871a8

SHA256
dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18

SHA512
5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85

Download Submit