Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 21:46

General

  • Target

    SetupAuto.exe

  • Size

    512KB

  • MD5

    ff0198fd1f59b71c1deec34b6b0b0c07

  • SHA1

    cae622ad91a3bab0996589e3bf905c9d4eeb6059

  • SHA256

    f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5

  • SHA512

    96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc

  • SSDEEP

    12288:Qnm2P17YuUAlhZk4ZN5lviET7MacVdekBCaeKOKEZQM7gM7ZQN:Qnh17YuUAlh+S5ZdT7sbekOKEZQM717M

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
    "C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2032

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nstAAC.tmp\ioSpecial.ini

          Filesize

          693B

          MD5

          1d6b38a6166977dcc7d421ca9e9c0dac

          SHA1

          6b55e92af1a64ed46c999c761c5244c10318c837

          SHA256

          07f32d06e26f70164c181f03026b0c35d5639bf8a43b08c3c5a4967651f7b5ba

          SHA512

          2413b089a19e0ee3eaa8163c0cce7aa06bacc727f174dbf8f1041c61b356a30cfa6bdf87f137bc78b918ad6b7b40ffecdfc27836ef516d4cc30dee0587508880

        • \Users\Admin\AppData\Local\Temp\nstAAC.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf