Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 17:47

General

  • Target

    Setup.exe

  • Size

    505KB

  • MD5

    5d8d0c08384ad73216d52a2eabc064f5

  • SHA1

    0fa5c77fd6b6323b926c9648679e063d1bbc8bcc

  • SHA256

    30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce

  • SHA512

    42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57

  • SSDEEP

    12288:6xPm2P17YJbq9VXMLVS+n78L6OdBRdrrf3xr5Uw1jcZQM7gMyZQU:6Jh17YYVV+YGsBH3xr5Uw1jcZQM71yZX

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2188

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsy6681.tmp\ioSpecial.ini

          Filesize

          694B

          MD5

          60414c90f6b94b987a6ddcb737ebc37e

          SHA1

          2ed7147d4ae1ecc44d73b29408ceb2dbfe57bbd1

          SHA256

          097d1268d993d7a4309c84880e644ecd8d76abdbd0bb1c879161379af71e0236

          SHA512

          447ee8a00cb220d8fb98869d97ee2fe99e74910bd1d3e4707e1bfb9384ef470a90a6154c9552b9e59f6939ada916d414350e5faa0a6215e0973a60d536155966

        • \Users\Admin\AppData\Local\Temp\nsy6681.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf