23e36bbecb17b3499a8f72566d24a6ae3dc9ca60049bf68c838fb3cd387ed526

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

470ba5b7e34f8f4eef5d9b28f8a4923b.exe
Size

1.7MB
MD5

470ba5b7e34f8f4eef5d9b28f8a4923b
SHA1

d5d3d7db210b1e4d22d0c73c1527fcb3bd0d9f7c
SHA256

23e36bbecb17b3499a8f72566d24a6ae3dc9ca60049bf68c838fb3cd387ed526
SHA512

6a1341f2462d9505e876a232eecadd9c3f34744f8cf4cdd532658f77b446c756d8fc443e03076ac8835e6c33b8f2cff62c14765d76d372e865a1b65f36166295
SSDEEP

24576:7ScOqSPLtNZp3lOZ+FbCUndZYjXoAgkmHVLBMfsG3pC6d41eCXH7gyX7CY:XAPLxLOZ+FnnmFgkmV+pC6d4vbgCf

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2096	470ba5b7e34f8f4eef5d9b28f8a4923b.exe
2096	470ba5b7e34f8f4eef5d9b28f8a4923b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	470ba5b7e34f8f4eef5d9b28f8a4923b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2096	470ba5b7e34f8f4eef5d9b28f8a4923b.exe

C:\Users\Admin\AppData\Local\Temp\470ba5b7e34f8f4eef5d9b28f8a4923b.exe
"C:\Users\Admin\AppData\Local\Temp\470ba5b7e34f8f4eef5d9b28f8a4923b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst9687.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
\Users\Admin\AppData\Local\Temp\nst9687.tmp\tmpf5clx2.dll

Filesize
588KB

MD5
883870c98b16531ee96a80599fbcb0e6

SHA1
31fe918ab9d3df641f50c94845a392c7ee8d175f

SHA256
7e79634c6b95b3ed84d8393a61749cc9a89c72bf48c5665366a82ba9207dbbaf

SHA512
3372fb0e98d0abcbdb5c0f84efc2cab1f3110934c71cb844790ba4aa87b5ef8d1343a82bbed90b75c9bcc4a742a63b1cdfdcd735a145fa6d307dbb1bf8e8c835

Download Submit
memory/2096-12-0x00000000022E0000-0x0000000002423000-memory.dmp

Filesize
1.3MB

Download