eb40f8017e4e96c12878d2fa338f63c8ede67a98d0cb06e359beef7adeef9315

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CloudBox_setup.exe
Size

1.7MB
MD5

90534c072fac2c2fe2c73daf4cd5327a
SHA1

aca82a681237999daf6ebccf86cfd3976f4447d6
SHA256

5d91394df472216454a5331edffb199ddb64257bd4907f074061714ec58cfeb6
SHA512

6e9f792df1f92abf8e9d9cf2f64332ca416339e2a0477660c9f0ba048a5ec43e1e9c093592a922fb7986ba3252e2389c6ddeb9a1a7207de56fc23e95dd93d3c2
SSDEEP

49152:D1xA+afF9/b2cHnVGekHsWa/zlbYeXWZUMeT7rhn4X1:0+WP1GRMW2mUMeTH5i1

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2236	CloudBox_setup.exe
2236	CloudBox_setup.exe
2236	CloudBox_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	CloudBox_setup.exe
2236	CloudBox_setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	CloudBox_setup.exe

C:\Users\Admin\AppData\Local\Temp\CloudBox_setup.exe
"C:\Users\Admin\AppData\Local\Temp\CloudBox_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstC32.tmp\ioSpecial.ini

Filesize
590B

MD5
84e49cee5d2e647cc7dbb13ed4fd89e6

SHA1
bde718f774c87f14af01283e34854062d8cda225

SHA256
4f1ab064f5afa273ff1916dda34dd2174e5b77387d3e09a0c3352fc9c93f2939

SHA512
b5c3f2bfd8e6a766b533f209db75b2e3b231b60dbdde1fcfae74e5b0c87b5220235f8956ddae3cefdd54e4315fd59276cbe91c15fe53ad3f7df31b04c7fd2e0c

Download Submit
\Users\Admin\AppData\Local\Temp\nstC32.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
\Users\Admin\AppData\Local\Temp\nstC32.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nstC32.tmp\processwork.dll

Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
memory/2236-9-0x0000000000440000-0x0000000000481000-memory.dmp

Filesize
260KB

Download