70af968d2b39a19390ed0a956771a368ad5940294a74f633d5735678784cebbe

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97e54ac54231767138753fb2c815a1b2.exe
Size

64KB
MD5

97e54ac54231767138753fb2c815a1b2
SHA1

7c67201e0a6b3874bb942dd5a26d8f1d5f8317f0
SHA256

70af968d2b39a19390ed0a956771a368ad5940294a74f633d5735678784cebbe
SHA512

2f66f62082ea24ae7cc651b2c7709a9fc54fa14e8f7388659d90e3b42b7532a7b55a83b2b676381c852c071815bab1d82ec4a0a297671906e203b18c8f3531e0
SSDEEP

1536:c8c2IoTp9pvPoZmE8d/XJL6bqoXwyxv/9DIC3xizC3xi/:jc29Tp9pltdXJubqAFDICGCa

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2840	97e54ac54231767138753fb2c815a1b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\97e54ac54231767138753fb2c815a1b2.exe
"C:\Users\Admin\AppData\Local\Temp\97e54ac54231767138753fb2c815a1b2.exe"
1⤵
- Loads dropped DLL
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsqC6FB.tmp\UserInfo.dll

Filesize
4KB

MD5
8ef0e4eb7c89cdd2b552de746f5e2a53

SHA1
820f681e7cec409a02b194a487d1c8af1038acf0

SHA256
41293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc

SHA512
a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5

Download Submit