Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 00:27

General

  • Target

    088aeec93865f09a292e362fbd54062f.exe

  • Size

    3.5MB

  • MD5

    088aeec93865f09a292e362fbd54062f

  • SHA1

    de6962f0ed6b8ec852446a3010e73e30743ce035

  • SHA256

    4f97bb5f2ebbb0b2af8e8c408ab66bfcc522dedbc5c55b2e2124ad11310d7cc6

  • SHA512

    2abb9720211d95c747b34d23536fec07f71c6525008ad4b5b2bd5c71251983b9d9f563b0dd934d11734d6c71e651e6baf9774d4161ea0c59248c96bf9c101415

  • SSDEEP

    49152:VV1dMQQ/6AxR5eFr3bkZI7JM9ZtvRDEOINJsCWcEcgnth96qI86PHZMaCLc0G3Dg:Nda6Kyry3hNE6CWlcgj96VPHMG311I

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\088aeec93865f09a292e362fbd54062f.exe
    "C:\Users\Admin\AppData\Local\Temp\088aeec93865f09a292e362fbd54062f.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd98E7.tmp\tools.dll

    Filesize

    236KB

    MD5

    e12f05661436f2974cf91b5fc76fb5f4

    SHA1

    5e0b7887950204713bef3da0018911279f2540ec

    SHA256

    1873de723938193f9f0877b08c160884b79503b6607598158ad99bd909189fdc

    SHA512

    61d42e055865dd98552b29dd69dc3d761bc7f77c1af108ad13b0b390059be5668657645258c0c08052a5fe1e9f6bdb018da136eb103b7335097487ec0de5d22d

  • memory/2164-19-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/2164-22-0x0000000074050000-0x00000000745FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-24-0x0000000074050000-0x00000000745FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-25-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/2164-26-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/2164-27-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/2164-31-0x0000000005E20000-0x0000000005F20000-memory.dmp

    Filesize

    1024KB

  • memory/2164-30-0x0000000005E20000-0x0000000005F20000-memory.dmp

    Filesize

    1024KB

  • memory/2164-38-0x0000000003240000-0x0000000003280000-memory.dmp

    Filesize

    256KB

  • memory/2164-39-0x0000000074050000-0x00000000745FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-40-0x0000000005E20000-0x0000000005F20000-memory.dmp

    Filesize

    1024KB

  • memory/2164-41-0x0000000005E20000-0x0000000005F20000-memory.dmp

    Filesize

    1024KB