f64de4aee0bc21db63da573ccb97b7d9a8d1e8dfc29bef72d8c8f26c4ec640cc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/Setup.exe
Size 3.3MB
Sample240203-edmf8sgdc9
SHA256 03b586c9abd1ee2b3b1d12abe4b27f5e239ab4d4f0cf385e2a015a5c013a2b26
MD5 0fb2c525c1093751a0242f92ffd242fd
SHA1 67e9c647e1a9a6b83dfb67f64dc88243912d1c08
SHA512 c49b5b98192e0c178a1e905eea6b82298baecf320d68de16c8b211e1ee885fac68046d97239309ca41a0a3bccef699f95c1b073188bd12c56a20e450e0a95f0d
SSDEEP 98304:9P1CXQNTu7+5TT0PKqD4m6CT2aYNWpqTXY++rgiSlOq/h7:3CXQy+1giqDj2hGQY+3ROg7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1244	Setup.exe
1244	Setup.exe
1244	Setup.exe
1244	Setup.exe
1244	Setup.exe
1244	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	Setup.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi190D.tmp\ioSpecial.ini
Size 593B
SHA256 6092fb03a12b32ca545b3f4389b7986926668d30ad7b5fa1933e2c06bca40b6f
MD5 31fa82b803f6ef21260ea6da79f84efc
SHA1 de1a0c8bb7687037badc1f0183cc04c106040990
SHA512 9fcf40556774ef193f02d25ff282dd5d8dacab83329493af19b5ebd53dedc908fb2aa389a5dd61f100a1a7d65a175702e5505d3d506c2931bc2be2aadea655a1
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nsi190D.tmp\InstallOptions.dll
Size 12KB
SHA256 0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
MD5 1d5c649dde35003a618b9679d5d71b92
SHA1 0409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA512 b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
SSDEEP 384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsi190D.tmp\System.dll
Size 10KB
SHA256 cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5
MD5 4eff5fafd746f5decb93a44e3a3d570c
SHA1 a11aa7681b7e2df1c7f7492a127d332d1495ea8a
SHA512 cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72
SSDEEP 192:0OycJo/rJVCmIDNLU0dq5RD00lspbub76yL:6/QQ0d0RD0USq/6y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads