6e1ecfbeb5f7b87342b86bc7f2ca02e556e7aca8041afc1092988ece59fca901

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

documentsrescuepro_setup.exe
Size

1.8MB
MD5

c4ad6e5f6bc31d658532486d63f8af02
SHA1

dc3ad6882abe0d91a04ec93b2c580793c362ab70
SHA256

e8eb3dd5cee306e41f4636651b4e72012bb4d50a0f258d3b82fb1d2ae147315c
SHA512

2bcfa7afe95020cf55519a459a061479b3c2726c3144c178518cab45ef089093bf025976e6cc6d9847787f4dc4ccce3170e7c658d263311800e7402868bc9ae4
SSDEEP

49152:xBj/VHjHesuNLkO9oE1Mr6vfHRrGe51AaK1JFjtvOra:zzpLxqTMrcGecaGFJvr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2084	documentsrescuepro_setup.exe
2084	documentsrescuepro_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	documentsrescuepro_setup.exe

C:\Users\Admin\AppData\Local\Temp\documentsrescuepro_setup.exe
"C:\Users\Admin\AppData\Local\Temp\documentsrescuepro_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd3BF8.tmp\ioSpecial.ini

Filesize
714B

MD5
11e6dec76582f57efb231130e424e858

SHA1
bb0dde1dfb3d6280195bb8c6b5b712bd72119b13

SHA256
c9e79057b3a7b1fdc06e92929296d2a3238edf7f8f1f9be7b02cb52919796476

SHA512
525a6475a5c1e0ac6d3a0af45892a2812f744fa5cc2da26539884b153501d3349f60871feb057a6739aec1b895c418894b6b154c8eb2118ad5170cca32c845de

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3BF8.tmp\InstallOptions.dll

Filesize
14KB

MD5
b18dfaded8f6d2380fdfd8f6b6969211

SHA1
969fa0e906240ab1123254feeb833c275626cf76

SHA256
747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58

SHA512
25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c

Download Submit
\Users\Admin\AppData\Local\Temp\nsd3BF8.tmp\LangDLL.dll

Filesize
5KB

MD5
9b17a13f814b137f88b961c087858063

SHA1
c290dd3139b79aa340aec3ed3d674160433035e1

SHA256
e54792a179a06acbb9b69c117ee804dce070505d1853d6e7d512f2a055a801b2

SHA512
3a625f5f13e344c24973c79c074d1ced4d9206f87f392dc7c8f0c116d0f2b878b60340e2377d0240c47f0e34e25e4e3af8b196bbca1c6a29a0f51d8408e8b0ec

Download Submit