019ea41357a9f279b02ab96fa77048f4e3892503889fd2ebb0bab89dee405d72

Analysis

max time kernel
155s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 08:38

Target

4063d7fec7b3fc030c554dfd30fd57d2.exe
Size

3.3MB
MD5

4063d7fec7b3fc030c554dfd30fd57d2
SHA1

4a3d128868a9cb95ac6d14530059d759a043fb88
SHA256

019ea41357a9f279b02ab96fa77048f4e3892503889fd2ebb0bab89dee405d72
SHA512

b8d98cd4c21a4de0c8a8d95899760b2d8ebfc7530de4ffb826040d4cc42a0d462e96d4fd92a796986433f8d2825cd548688fb3eb5e444a793ecc33791fe61263
SSDEEP

98304:iwh7nMmYp7vOhtwMuSJXBEFi5BUnMHRargrp/:xh7byupVJXyMXZ

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1212	4063d7fec7b3fc030c554dfd30fd57d2.exe
1212	4063d7fec7b3fc030c554dfd30fd57d2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4063d7fec7b3fc030c554dfd30fd57d2.exe
"C:\Users\Admin\AppData\Local\Temp\4063d7fec7b3fc030c554dfd30fd57d2.exe"
1⤵
- Loads dropped DLL
PID:1212

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsk1DD1.tmp\InstallOptions.dll

Filesize
14KB

MD5
d970f6e5200a676ded18b2dfb39a3352

SHA1
1d48fb37758c09f3f2a083a2869143383b68daec

SHA256
c2ae27669651fd5d3142e35d3317f46b7b3a9683b49f93ccf575628d55e8a6da

SHA512
86798df839c84e2dae4596f5b210edd18feaf8637ebe7925b7d80015ff321d324da47f129b91fb1c3229cac8d4f45de5758069a3e7cce7c9dd2d19e305131982

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk1DD1.tmp\LangDLL.dll

Filesize
5KB

MD5
0256f5be02329ee0933b1cebc92ff3fe

SHA1
4139ac54f2b9e1f0ab72ec8966159d931107d0b0

SHA256
cb4161c8e340e2843cd7ad32dc6f69115af32cf4ed42272abf5ef338a1473845

SHA512
337ab19f6eb451ba0baaec319d4810e647ead7bdc7f3e0ae5a2dc7e0d5dadfe500bb74ca0f577f1003de8e27418cc35268b7da948878f577f6cbb0ec5b315b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk1DD1.tmp\ioSpecial.ini

Filesize
688B

MD5
d71132a9fc04e82a34a45525d7a3cb7e

SHA1
993e277f07876d5bc1d112982d66740fff06abb6

SHA256
016a1866acb0d49690a6383c659bb3958c7008215b4bf47526fbbb7c7cbc965f

SHA512
bb9b1b5b8d8618b3e469080ee1af8aaf2aec09fc24f8905512cdd10dcfa7822e65e588e3d355d375fe3ad2ad1d12add0c10ad81082b0e2972bd3a99d92030980

Download Submit