dcba57772d1bbacf6a5077aef703fb563e95687c1ebaa658d1ef70d852733856

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b80911216e937ae4657566265d81e3a.exe
Size

2.4MB
MD5

7b80911216e937ae4657566265d81e3a
SHA1

9b4f38ae1d688f91d11ac231fe51d07955684173
SHA256

dcba57772d1bbacf6a5077aef703fb563e95687c1ebaa658d1ef70d852733856
SHA512

6d27ed8a463caeacb8f848e14f70087d14424b504fdb3f88f659b2cf30102c5e92b73364dc7c2c9d661666090a174e3a9004cbdad0ade9aafe5f62509bb13fce
SSDEEP

49152:yW4uDLS1BwiTND9Q1zPQsnHdtJ5drkiDndEcLRzIDhGwXoAB3:yuDLct1S1zPQGHJ5eiDn7LuDhGwZB3

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
628	7b80911216e937ae4657566265d81e3a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
628	7b80911216e937ae4657566265d81e3a.exe

C:\Users\Admin\AppData\Local\Temp\7b80911216e937ae4657566265d81e3a.exe
"C:\Users\Admin\AppData\Local\Temp\7b80911216e937ae4657566265d81e3a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi11BE.tmp\ioSpecial.ini

Filesize
517B

MD5
f5a1cfa594b4c58585e510f3de6973e2

SHA1
427974caaff67a55bab23b4a3b25893dd50eed27

SHA256
7b6b07caea5e1e0737c9f83b3d532495bc8b57f03f08385c3a3497ebbe99436e

SHA512
8460da3d68b1f87305e1d4e63de332e62ccf22f47c904e6bc1698317b0013c25b68c10dccee3abef8d9b73c7b4676192c17494f55e4ad0f6ada95278be8bc97b

Download Submit
\Users\Admin\AppData\Local\Temp\nsi11BE.tmp\InstallOptions.dll

Filesize
14KB

MD5
ec48a8204e1aed3d9a951cd92158cbe3

SHA1
0db29522e15448553b697b88b31a3d8392efd933

SHA256
3166399ed2ee296749aa412a4ec70807373b6349e9b94a7fcd97c3418f744f0f

SHA512
9b0ab63fbe4bf89ddf93e5fc6922cc95c0586e21dea945ce04065afd7957bd2472e34c909d356123346f62dee4c6d6077a0072810c91b61ad3df4c168cdb79d5

Download Submit