a4ab876393eb94c7175679b9d5fd8f497a8ec942d76f4c35d78dbbe398adf937

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winxmedia_dvd_setup.exe
Size

2.1MB
MD5

7f519bc18a1b2f1c4dc107893a6445d4
SHA1

3526cf9b3227a2b84c42b6830bc26fe271db1d6e
SHA256

2441a10caf0c7313f5f3b0e88aa8411315d7059d6b3d883ecb71491c243cd0b8
SHA512

600d4e28ace0efd89e39a791880b39de3bdb5b2657dd92f9bad2c991a9de838b8f144364ca5b35b83b871e7388393583bd4c8f9ed43699a56a1046c22f94e4df
SSDEEP

49152:C6vJjr12zJqPlR+0vo3ynexSI3wdZ1nikOI8MrcNK6NtFYPe5BY:zBr12dAR+l3wPOUr2KpcY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4180	winxmedia_dvd_setup.exe
4180	winxmedia_dvd_setup.exe
4180	winxmedia_dvd_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\winxmedia_dvd_setup.exe
"C:\Users\Admin\AppData\Local\Temp\winxmedia_dvd_setup.exe"
1⤵
- Loads dropped DLL
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa7B99.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7B99.tmp\LangDLL.dll

Filesize
5KB

MD5
ee0133034388b6c9f2794dc85305777d

SHA1
0ac841fa0c33e3ac223647542310f56e6ed10bce

SHA256
41dbd0dec3752da0423e6fa7f9ee17bb98b95cea007b61c99151ad546a130bf2

SHA512
2d5f411fccc78705d14dad419847894c014b40a4e89d26bfdf07e342b5618d46abb9479d62aba7349939a9185b5be4806c6123d9e139893845a6f6e04be01eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7B99.tmp\System.dll

Filesize
10KB

MD5
16ae54e23736352739d7ab156b1965ba

SHA1
14f8f04bed2d6adc07565d5c064f6931b128568f

SHA256
c11ffa087c6848f3870e6336d151f0ba6298c0e1e30ccddf2da25a06d36a61fc

SHA512
15dbfcdc5dc34cb20066120045e3250f8df9e50b91de043f2ada33ac0235907d98668e248828a7ed9c75e25dfb5103b7248867530ce73ee36f6a35c30b4afa9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7B99.tmp\ioSpecial.ini

Filesize
754B

MD5
c49bfda6170d324501672a07ced749a4

SHA1
7ff4fca03bbd1ef260e9f68381e6084291b1438d

SHA256
c9e8e4a491fab936c03d176ab68d578216ea5c875527a9df085e4c9ab2d81d66

SHA512
68bb122efbf613b8f9bdb8c212a8ebbff19e964d48fda9408f4885bb861e69efc1f54462759453012fe17a15493efe7288a7e4c1a556b3971c662d973f95d2eb

Download Submit