e22f88d07be98c313f3413e10062af4c1c96039a23439a8699d51b55faf53c8f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d08f057852f3090a59637172e881c9.exe
Size

1.6MB
MD5

29d08f057852f3090a59637172e881c9
SHA1

1a8d36622c3da0239b29f6da7cc7257085411fc0
SHA256

e22f88d07be98c313f3413e10062af4c1c96039a23439a8699d51b55faf53c8f
SHA512

f6eb76a7e341ed942eb13b2d6346f32b0ec04f44865317e5d0fa02720da81a9e98d0a6b91c13f6bbd9f0afd1bcb1a9e0bfa6b2f81e2de701d9cb9d7b5f8f3dd0
SSDEEP

49152:76Vlp33SHh5oCeV9A6hmlCAMQQxgv/YOoKR+:7yv3AVeVq4mlwjM/YOo8+

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2932	29d08f057852f3090a59637172e881c9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2932	29d08f057852f3090a59637172e881c9.exe

C:\Users\Admin\AppData\Local\Temp\29d08f057852f3090a59637172e881c9.exe
"C:\Users\Admin\AppData\Local\Temp\29d08f057852f3090a59637172e881c9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi1121.tmp\ioSpecial.ini

Filesize
744B

MD5
abb1f225124f12d1ac39a55cc7c5e701

SHA1
87e1a74e4409dc4f8e00bc2d03a6e57b5e18c793

SHA256
0a4dc3e7cacfff3fd279e15ac00647d21ef1f99e6470a2aa1788c2b001317388

SHA512
99e046657f305dd91e1983260dd07b2bec2f120b37cf0863e31b431b6c3b04967eb24b789e3b19e9a4ff0e79f290247f06ebacba978c558b0b4e741deb7e33e9

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1121.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit