Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 17:47

General

  • Target

    Setup.exe

  • Size

    505KB

  • MD5

    5d8d0c08384ad73216d52a2eabc064f5

  • SHA1

    0fa5c77fd6b6323b926c9648679e063d1bbc8bcc

  • SHA256

    30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce

  • SHA512

    42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57

  • SSDEEP

    12288:6xPm2P17YJbq9VXMLVS+n78L6OdBRdrrf3xr5Uw1jcZQM7gMyZQU:6Jh17YYVV+YGsBH3xr5Uw1jcZQM71yZX

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    PID:2180

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsv47C8.tmp\InstallOptions.dll

          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

        • C:\Users\Admin\AppData\Local\Temp\nsv47C8.tmp\ioSpecial.ini

          Filesize

          694B

          MD5

          c530a93f428773e35a41c28456ff27a3

          SHA1

          b8a22d0c47ba4639d57c1bad03171d0475691fb2

          SHA256

          ab72923553a1d025069eaf0c94cba6d40f42cf1bba610ee49a858b9eab7410e4

          SHA512

          8b8869e3f8bfdff9ce359a399bd60ffc9755b036933ea847232f379da1818de036b5731a698ea6706c56ef3749e827f1b30de34b61816b2c82ab27bad4ddf7f1