a4ab876393eb94c7175679b9d5fd8f497a8ec942d76f4c35d78dbbe398adf937

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winxmedia_dvd_setup.exe
Size

2.1MB
MD5

7f519bc18a1b2f1c4dc107893a6445d4
SHA1

3526cf9b3227a2b84c42b6830bc26fe271db1d6e
SHA256

2441a10caf0c7313f5f3b0e88aa8411315d7059d6b3d883ecb71491c243cd0b8
SHA512

600d4e28ace0efd89e39a791880b39de3bdb5b2657dd92f9bad2c991a9de838b8f144364ca5b35b83b871e7388393583bd4c8f9ed43699a56a1046c22f94e4df
SSDEEP

49152:C6vJjr12zJqPlR+0vo3ynexSI3wdZ1nikOI8MrcNK6NtFYPe5BY:zBr12dAR+l3wPOUr2KpcY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2944	winxmedia_dvd_setup.exe
2944	winxmedia_dvd_setup.exe
2944	winxmedia_dvd_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	winxmedia_dvd_setup.exe

C:\Users\Admin\AppData\Local\Temp\winxmedia_dvd_setup.exe
"C:\Users\Admin\AppData\Local\Temp\winxmedia_dvd_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi7FD.tmp\ioSpecial.ini

Filesize
753B

MD5
295d6372a04256d777c786376d5eca3b

SHA1
64a7ce4894a7d75d3f9f277d8510a93abf1ce5c8

SHA256
ec776b4f844b545d581215dc30a05dbfd332273c56a7f39a6ad0a47926908c0e

SHA512
0289c1ee5590db22a2f29d9ffdcbcf3cd1cada56cb2c3d8f11e19b55281c889575d3b7e2d91b20478927bd3c18ca737f266f22d41e41cef01b7cce0ba0a50c70

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7FD.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7FD.tmp\LangDLL.dll

Filesize
5KB

MD5
ee0133034388b6c9f2794dc85305777d

SHA1
0ac841fa0c33e3ac223647542310f56e6ed10bce

SHA256
41dbd0dec3752da0423e6fa7f9ee17bb98b95cea007b61c99151ad546a130bf2

SHA512
2d5f411fccc78705d14dad419847894c014b40a4e89d26bfdf07e342b5618d46abb9479d62aba7349939a9185b5be4806c6123d9e139893845a6f6e04be01eb5

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7FD.tmp\System.dll

Filesize
10KB

MD5
16ae54e23736352739d7ab156b1965ba

SHA1
14f8f04bed2d6adc07565d5c064f6931b128568f

SHA256
c11ffa087c6848f3870e6336d151f0ba6298c0e1e30ccddf2da25a06d36a61fc

SHA512
15dbfcdc5dc34cb20066120045e3250f8df9e50b91de043f2ada33ac0235907d98668e248828a7ed9c75e25dfb5103b7248867530ce73ee36f6a35c30b4afa9f

Download Submit