26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 01:14

Target

2a000bb220b57349cb25db153b3134bb.exe
Size

12.1MB
MD5

2a000bb220b57349cb25db153b3134bb
SHA1

30bec935053b18834ea182d6629b83b163a2835a
SHA256

26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9
SHA512

2d9933cd8da54a7f90e77f80039a64339d18b8087c18021d8699265b2e60247da45862b26a3dc66dbb7b75a5626f38a1917320b5c529ecd4b81a284e73caf517
SSDEEP

393216:ckaZIQhftMAb0VaZMKqRttuiEyJhxuuGNxgUFQo:ckai2ftvb0s+1lEMhmN1F9

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
3192	2a000bb220b57349cb25db153b3134bb.exe
3192	2a000bb220b57349cb25db153b3134bb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2a000bb220b57349cb25db153b3134bb.exe
"C:\Users\Admin\AppData\Local\Temp\2a000bb220b57349cb25db153b3134bb.exe"
1⤵
- Loads dropped DLL
PID:3192

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsj4519.tmp\InstallOptions.dll

Filesize
14KB

MD5
2a03c4a7ac5ee5e0e0a683949f70971b

SHA1
3bd9877caaea4804c0400420494ad1143179dcec

SHA256
d4f0042d8e7622b7e14395e926dd02edab3cdc77e82d88108b67a4d2cee9229b

SHA512
1942cdb522859f8dba46824786e361794a62e6201279201e1e0e2e07499fb6252933c5661782fccd77291c3650cafb2a7a08eee5431c8238f0da44840ee4c476

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj4519.tmp\LangDLL.dll

Filesize
5KB

MD5
ebd0da54db9f12ffd15206cc24355793

SHA1
910be3bebdde55eb1ce05915a79f01ebdc622786

SHA256
4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6

SHA512
cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj4519.tmp\ioSpecial.ini

Filesize
689B

MD5
379103c581e1118ef3f75f4ec859747a

SHA1
a999fd89871a80fca2439602ec15605b8aad11da

SHA256
263bc293108e7ad43e01fef88b6177ae3cc470e71db87b7735cdf9c8f9b2831e

SHA512
48efb93e68d906d646c172bb256a7cc75a38c4e4676658dfd5b6280fc168845eb428754734048ee33203d72227dedc6863c5021ccdbab7a9e8d1ef4f23bea8ac

Download Submit