1b8390e17adeda11c7e22f534c579c079131d4e2301d66e8c657bac617f35f08

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

514ef93817bb2d5eef6313c1ed45b12b.exe
Size

449KB
MD5

514ef93817bb2d5eef6313c1ed45b12b
SHA1

9f0befdf7e0a98b352496c4d0c0c918c34f90765
SHA256

1b8390e17adeda11c7e22f534c579c079131d4e2301d66e8c657bac617f35f08
SHA512

61482e559e617942ce34a510abcf1dea9cff427a29ce76baaa5b36f6fd27e920359269e62d6e518fd7fa0537d08eed0ef4542855ff600586b212258a52b2c327
SSDEEP

12288:UltC6LV/B+uaE+1ekTaVlnvEUJVdZEjKZ:UNvuWVlnvTPkKZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2432	514ef93817bb2d5eef6313c1ed45b12b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	514ef93817bb2d5eef6313c1ed45b12b.exe

C:\Users\Admin\AppData\Local\Temp\514ef93817bb2d5eef6313c1ed45b12b.exe
"C:\Users\Admin\AppData\Local\Temp\514ef93817bb2d5eef6313c1ed45b12b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5F41.tmp\ioSpecial.ini

Filesize
652B

MD5
b24b3216cbcf7b610a8ea9c438f238ab

SHA1
013feb1562a3c2b81102e0a550ab0bfe61432795

SHA256
a993c82137d2c643329eb773bf7aba96407905c28ef85c4135bd68443b689e42

SHA512
240d8cb2e4d04d10145e43eff560d1a372769ae15631898497a40d371e52c433fa6fca9517e754c2eb926ff38a5979609595504996d099cc6aa7f34901e1f99d

Download Submit
\Users\Admin\AppData\Local\Temp\nso5F41.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit