c1db2080f5efb41426a023410576b8d834f7b3c7c37ce152337eacead497337c

Analysis

max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:16

Target

HA-ApolloD2iPod_v33-FzH/Setup.exe
Size

3.6MB
MD5

9c63c621ab7cdec46c2a768c7e6805ce
SHA1

ba1517a37505db865b9645de50f1cff3d46ac72a
SHA256

4336e926add106b2d6db7d32e3ab0fb2047c8b92363122589f0f8784f1cbbfd7
SHA512

210952c9604d874ba46efef04acb9804e7b3106b63e841d5129ba9f2eec1a73e3073db2d5a87736a33cc63c8aaf7faefbbdd81bbe7e644c42cac9b5748ac3cf8
SSDEEP

49152:MsU1WFC0NTsl3krazj2Z8q4PjEhlVoxv/8i1Mb6Pr86l9w/KD4CVWjOceN+8Jr9L:MsU1cneUraze8q4AuURyLr9Meo8JF/

Score

7^/10

Loads dropped DLL 3 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\HA-ApolloD2iPod_v33-FzH\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\HA-ApolloD2iPod_v33-FzH\Setup.exe"
1⤵
- Loads dropped DLL
PID:1172

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsc3F2E.tmp\InstallOptions.dll

Filesize
14KB

MD5
113323e18d1ffbea2569ede8068615f5

SHA1
057d67d3bf635b24ae12380353a0507469f1c8d7

SHA256
dad65aa69fccb608e7bdd620a6b8bf3eb9cfd720a1ff24d6a23837e25eae1ab5

SHA512
b55cb9f5b9f45559cbaed1657ce0469d606043d49a1b65f2095867437a8b7fc067207ad775df54d7eb3d607c4b30b29cafb6e23c7863ade5e4a362aa30116ee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc3F2E.tmp\brandingurl.dll

Filesize
3KB

MD5
9c3488b5e9655d1837c3963ecec33f70

SHA1
f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

SHA256
05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

SHA512
6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc3F2E.tmp\ioSpecial.ini

Filesize
650B

MD5
758d1a0f1612fe22b30da421027dc251

SHA1
4d9c2521c8338f90e40355b0b267e49e01d7282a

SHA256
e39097cdb92f04fd62972fda234fa3253206938c2b3b461f7da764dfcd6e5fac

SHA512
0454d208b59ebc1af06704baf41aefd05019406742979eee7a6ecce5d65dc702798f7db1519071b793d8613fd10bc37e101123014c4f61ee393eb402104e887e

Download Submit
memory/1172-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1172-90-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download