cbb9339a928348bf8ad84a57b46e3df22a2ba327c5a0f2aa26607d3af14e917c

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HA_EasyVideo2Audio2.06_LRH.exe
Size

3.3MB
MD5

dc835b4f95ccbde89d0b248ed500da07
SHA1

4a5ae07f30f0ad9217af4cc315cbc3368877c3a6
SHA256

f6ecc278fc94a0b64895fa609eae6a279fe8eac5cf8130837cd3374e3cacd0c2
SHA512

95a8a7c7e85c4579d8d5cfbbd70e642c96e9c239a159642f61c4da3e0aa71d081f4d1c9d218117e361736f1f1550a7220424c90723f8815969c21c429a6b907b
SSDEEP

98304:M9tOWw6mKfkbVAATkY53DjpQPNKMhVTB6Jy/qIVVzrUF:LTbbVHYas6ASIDy

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2448	HA_EasyVideo2Audio2.06_LRH.exe
2448	HA_EasyVideo2Audio2.06_LRH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	HA_EasyVideo2Audio2.06_LRH.exe

C:\Users\Admin\AppData\Local\Temp\HA_EasyVideo2Audio2.06_LRH.exe
"C:\Users\Admin\AppData\Local\Temp\HA_EasyVideo2Audio2.06_LRH.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst7A31.tmp\ioSpecial.ini

Filesize
684B

MD5
ea1016b40fdc2d7a40f43b745cb9c0b2

SHA1
39c393889dcd123b8e0568c5ab5275da9b5a376a

SHA256
29ecdbbbdd256d1929d749efe908065952a079361485ef314c9b7d4c093309c5

SHA512
9a869dc2e137201b0d9a8dfab0dffdeee6c123888fb0260b306140b3233cde7087237c9a3aed794ca0c5e4fea36fa9acfdf4ac2e5e9492b05810a3a1a2b4a03b

Download Submit
\Users\Admin\AppData\Local\Temp\nst7A31.tmp\InstallOptions.dll

Filesize
12KB

MD5
83304a78d2b6ea45ea8404f4cd78721f

SHA1
d5c5d19653c751c08579dd094bcc9fef1841af00

SHA256
92344973083c0a5d8f5732814c1315124e8e0a2f1ed912583a081f95f7549414

SHA512
94076cc935927925641d668c19b389d007ff7e8623f2afe706fc73d1ecb97210577a828a727404b200d9870e14b23d6bd047de9201d629e7443a929c0740c67e

Download Submit
\Users\Admin\AppData\Local\Temp\nst7A31.tmp\brandingurl.dll

Filesize
3KB

MD5
9c3488b5e9655d1837c3963ecec33f70

SHA1
f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

SHA256
05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

SHA512
6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

Download Submit