ec413c06a7ba6c3ef08c7350bebc0be7fc0fbb98d9071bbeccd819a9df7191d7

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7458897bb806377a8bbc7e4a50158eb2.exe
Size

4.9MB
MD5

7458897bb806377a8bbc7e4a50158eb2
SHA1

f627f2f1517431e632d258c4f0c12a0b3c31f317
SHA256

ec413c06a7ba6c3ef08c7350bebc0be7fc0fbb98d9071bbeccd819a9df7191d7
SHA512

fdd11383ef87920e06c5a015cde2bd93b720c449473ae098b93579e2e37fc69ad3caade58a6d73fb2de916ceafcfc5740140469213b98a4f3d819fe1a8146f08
SSDEEP

98304:WyS28dONkOlXjQS09tE7HrGRcxKTuK9DRyMRm8TMhwNvtsorjgSC:xIdHOpMSVaRcxxKBRfRm8wwNViSC

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1988	7458897bb806377a8bbc7e4a50158eb2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7458897bb806377a8bbc7e4a50158eb2.exe
"C:\Users\Admin\AppData\Local\Temp\7458897bb806377a8bbc7e4a50158eb2.exe"
1⤵
- Loads dropped DLL
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso66DF.tmp\nsDialogs.dll

Filesize
12KB

MD5
cc1302234015bf9787d158e5554a0139

SHA1
f42e262bb9a2130db668af324b5e54a8891b7e46

SHA256
829c15b7dad26c39b69a55e8b888ae14029fc3d701d73f77b8af38b9db6dc67a

SHA512
fcf583a9dec95071a07e11f870d7a97739ad51a1dfe9b6658341ebf0205d4c6435574e2e7f4cb7b12d502df7f5f5376d266a9006c1fd30bf5d6c735686ea2f0a

Download Submit
memory/1988-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1988-6-0x0000000075080000-0x000000007508B000-memory.dmp

Filesize
44KB

Download