813ec1fe7e215a65f673b575d344ef489769e83c738a65fe42556475f6ff1948

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FSViewerSetup31B.exe
Size

3.3MB
MD5

ed8aa0c4bef1180605c00bbd35b9e215
SHA1

995fb0dfdc5ae5b7a933e02f86bc8e5af52c40fd
SHA256

0d88369db08ecfd3496ab85a2fb1a49bb4ad6288023076c7d5a835c4eac5d5b1
SHA512

2edee3510a29497a2b66f65c4f66b60d3780ebe486f9f673c1e105fac81296adfc5c6131a7ecf0e005d8c32ac0c6bc1393e42b00f8190a6b0b47d6d22c65c4be
SSDEEP

98304:pO4UDEi2FkJhw1ISouOjNRQOyM9c1FuKvLmtsl:pPUDEVFkJ61Izfjky2/uKvitsl

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
952	FSViewerSetup31B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	FSViewerSetup31B.exe

C:\Users\Admin\AppData\Local\Temp\FSViewerSetup31B.exe
"C:\Users\Admin\AppData\Local\Temp\FSViewerSetup31B.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd4D2.tmp\ioSpecial.ini

Filesize
729B

MD5
51a449fb93e62e2498725ad050aaebbe

SHA1
f6acbc0ccdc4c6321ebe85fb12efaeadacfb9b54

SHA256
5a16c2fcd7a7a5b8ffd80b9f88f97ff9bf403a64e0a9343f414c246e0182464c

SHA512
0494771cafe0d15bed605a8633f3fa067e7171d2a97fd5e6fd2de4ddeb54517bdebc511a0df74a5c33f89ec6e577be17e8916c3b8b315a3ea7d684d18abb6a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4D2.tmp\ioSpecial.ini

Filesize
742B

MD5
33c10273afbc3ed4c286a0baaed00e3f

SHA1
c6afdbef3b0fdc05862a9c161f301c13b523f15c

SHA256
541d0a8c49cbc0b4787e2d8ba0ce3dfbe406ebe68836d6489f047c3fc35dcaa3

SHA512
7ab1438392ef909bd91deb23cc25d446f22fd2e3e5affa39891a316aa7addb484cc9a1392b8bb9258c99314ced8c07cd6e41676fb785c7679799dfc97a076fdb

Download Submit
\Users\Admin\AppData\Local\Temp\nsd4D2.tmp\InstallOptions.dll

Filesize
13KB

MD5
d765c492c21689e3d9d61634371fd861

SHA1
ac200933671ae52c9d5544d0e2e8e9144d286c83

SHA256
551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

SHA512
9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

Download Submit