20ada7e16338e7fce24f3d5ef185451a42e0258f500efcf56d221f935357cb6c

Analysis

max time kernel
112s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62666221bfc9d6b6b032c0a6e36616d9.exe
Size

1.7MB
MD5

62666221bfc9d6b6b032c0a6e36616d9
SHA1

e0527b730da521956804483c1e99b65955e517fb
SHA256

20ada7e16338e7fce24f3d5ef185451a42e0258f500efcf56d221f935357cb6c
SHA512

ec92861bbf249517e6cbf600c639d7daf03b91c1cbe2cb53dadb442bb97092d3a66df2827fe2baecd4d37a36a15fb68555d47908bcc13e0b47d2962557bb73a3
SSDEEP

49152:lEKWhXRSMGiQyOHPDln2gPn4X1xmNVEHd:ZWymQRHrln2wY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1272	62666221bfc9d6b6b032c0a6e36616d9.exe
1272	62666221bfc9d6b6b032c0a6e36616d9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1272	62666221bfc9d6b6b032c0a6e36616d9.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1272	62666221bfc9d6b6b032c0a6e36616d9.exe

C:\Users\Admin\AppData\Local\Temp\62666221bfc9d6b6b032c0a6e36616d9.exe
"C:\Users\Admin\AppData\Local\Temp\62666221bfc9d6b6b032c0a6e36616d9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy8AA.tmp\tmptm32vk.dll

Filesize
95KB

MD5
877e7898a68205bda08167a0a2e838ba

SHA1
57e2c9da496b5704bea72b9434b4daf3acfac528

SHA256
a2e2c4620632032bcece303f73096ffde56eddb15e97d1d11bfb88551585bf54

SHA512
c7d3ce22a7da62eea37e5c6048f47d4ff078fe4cb19d3a089c1fd42504c5d800e7d2bf0011cdece30d01972d5909d3244af6be9e88dba3a2fae56a18186fb4c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8AA.tmp\tmptm32vk.dll

Filesize
102KB

MD5
96dfade1e61ac19fd21b64d378bb6692

SHA1
96b66d7536d74cc6c39313b3fbd8367153bc9faa

SHA256
5d8e821d43be438c7bc214140bbb0e9f884caa49455ea5a8bec2c10eaa4db177

SHA512
0b0580cdf0e79fd14a2e26811e1b54dbf47e52707bfa0ab8002ea232c0bfbb75df1e0becc8855c4bd1542bd82b199c8b034e9c3c23de36955483483e26b544f9

Download Submit
memory/1272-12-0x0000000002970000-0x0000000002AB3000-memory.dmp

Filesize
1.3MB

Download