1b8390e17adeda11c7e22f534c579c079131d4e2301d66e8c657bac617f35f08

Analysis

max time kernel
177s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

514ef93817bb2d5eef6313c1ed45b12b.exe
Size

449KB
MD5

514ef93817bb2d5eef6313c1ed45b12b
SHA1

9f0befdf7e0a98b352496c4d0c0c918c34f90765
SHA256

1b8390e17adeda11c7e22f534c579c079131d4e2301d66e8c657bac617f35f08
SHA512

61482e559e617942ce34a510abcf1dea9cff427a29ce76baaa5b36f6fd27e920359269e62d6e518fd7fa0537d08eed0ef4542855ff600586b212258a52b2c327
SSDEEP

12288:UltC6LV/B+uaE+1ekTaVlnvEUJVdZEjKZ:UNvuWVlnvTPkKZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4476	514ef93817bb2d5eef6313c1ed45b12b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\514ef93817bb2d5eef6313c1ed45b12b.exe
"C:\Users\Admin\AppData\Local\Temp\514ef93817bb2d5eef6313c1ed45b12b.exe"
1⤵
- Loads dropped DLL
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsxA7C.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA7C.tmp\ioSpecial.ini

Filesize
651B

MD5
434e356844a75708d0bebe3538ceb93e

SHA1
686579fb9eac33c8d51841ee30b19385987d0588

SHA256
6a81cd690a6c33d32f62ca6b6ad740a3ada3affa651e60403102a660ec27f5b7

SHA512
4827e1f56ebed7706c0c220929b6917b54785b98eeb7f8ae05fa246147919ff905adf1bacc86909520126b29bd88f51307174511c3c6124882689b397a433d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA7C.tmp\ioSpecial.ini

Filesize
691B

MD5
3d4b8e31a3677db933b0acd4dd09efbe

SHA1
4b5d3db3ccd2bd1fa0ddb0fbe0bdd100968f67f5

SHA256
5bfeed53dd9385394722097e72f3bd6c57e27eeee9328fb81fc9c4dd01e78ef3

SHA512
e4ba72f0b6553bf5021dbc05e0b54c2a28b8960dfbdfdb6f482c209304f6e4feb5067fcd6b38eeb03632bb576b3215626b29490a555c4d0bd0aa3a2f5ee6071b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA7C.tmp\ioSpecial.ini

Filesize
389B

MD5
f656b331b24ba037211d96364da1e8ff

SHA1
7f4ace7d8e9af73e044ece08357de6c84e59e3f8

SHA256
58805c439f336390f1ba188e4ec2d782b7006242c597a73dfa83b2135034ea65

SHA512
ec306fd3575d61f85fdf34510a7e5ecdc0c38ad984f0c07957d4758b0a1d7013b4b7273104e6e5bcffb24f264a53d714e8ec911ff2c64c0eb607b948894827a4

Download Submit