813ec1fe7e215a65f673b575d344ef489769e83c738a65fe42556475f6ff1948

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FSViewerSetup31B.exe
Size

3.3MB
MD5

ed8aa0c4bef1180605c00bbd35b9e215
SHA1

995fb0dfdc5ae5b7a933e02f86bc8e5af52c40fd
SHA256

0d88369db08ecfd3496ab85a2fb1a49bb4ad6288023076c7d5a835c4eac5d5b1
SHA512

2edee3510a29497a2b66f65c4f66b60d3780ebe486f9f673c1e105fac81296adfc5c6131a7ecf0e005d8c32ac0c6bc1393e42b00f8190a6b0b47d6d22c65c4be
SSDEEP

98304:pO4UDEi2FkJhw1ISouOjNRQOyM9c1FuKvLmtsl:pPUDEVFkJ61Izfjky2/uKvitsl

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4972	FSViewerSetup31B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\FSViewerSetup31B.exe
"C:\Users\Admin\AppData\Local\Temp\FSViewerSetup31B.exe"
1⤵
- Loads dropped DLL
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss72EF.tmp\InstallOptions.dll

Filesize
13KB

MD5
d765c492c21689e3d9d61634371fd861

SHA1
ac200933671ae52c9d5544d0e2e8e9144d286c83

SHA256
551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

SHA512
9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss72EF.tmp\ioSpecial.ini

Filesize
730B

MD5
b9e759af5d4efa21e1f8addfab9a5d1c

SHA1
11aea58a101efc7088ced666a6a071586caa0d80

SHA256
194116d3b6537b76740e054dff321c1f6dafd53daa96a74f6e95d199d97f9536

SHA512
e5f1f1527fbaf79f6768aaddf6c1296fc416f89cf9f6e626174f49d4c65c3a0f601c8d24550f019490bc35d7d7a720f06de328be619324b0603c001c8f6919ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss72EF.tmp\ioSpecial.ini

Filesize
769B

MD5
37f8b2c3e9bcd352e2f2b0426d34df59

SHA1
41106bc6ae3c836780c69ca21a8c03871dbfd475

SHA256
1b9891a5956983273772a12c44075b949ca1115f6d62bb995ff2ec9cfd130e9a

SHA512
a197b3d36800be566d2a9293ab492d06924ef178ad17db5486e810cfd55d54ff2de96f7b98fc423cd415eb4be68c4ccf1faae503d9cbb921fcd8d973d89208a3

Download Submit