Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    15/02/2024, 15:31

General

  • Target

    r1522024.exe

  • Size

    839KB

  • MD5

    35562de1445f84deee725deefe31b410

  • SHA1

    0e8168206e896875cccad315a2890820cae1cf33

  • SHA256

    7e08d267c3771ac900b9ecfe7b293aa7337a276a5929997180709b74114cdacb

  • SHA512

    a4b87335b32d87261eb93c9e5e1187adc752897659d6006e7ccad739ca20b2e80f111b4fd653580945e0664dc9fa3383dee7c8477093e2445b9a2a3f4ffc3fa1

  • SSDEEP

    24576:tMwT8bZSKZ+lKmxUgxDEuZ9WI+spi9iCnqVW:tMwHKi/x4uZ8dr9qI

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\r1522024.exe
    "C:\Users\Admin\AppData\Local\Temp\r1522024.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:2972

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Fonts\snlig.ini

          Filesize

          43B

          MD5

          75285908e15263897f2fe77cc637ef6e

          SHA1

          cc5a707cae259834b2453a305af9453b7b7412ac

          SHA256

          6fc175d4186cfb67d46e22b277602aa3ec665ad44c9854e7bdaf0e5a25cefbc5

          SHA512

          e93afaa0772d9aa9a8d77e44473a5c58cf9f3b214b76d5ed94e08dbc2ae9ef3d67b470073b83c157318bfa67fb44e17833af313efe8ded28e07d55272eb4edb2

        • \Users\Admin\AppData\Local\Temp\nso1315.tmp\System.dll

          Filesize

          12KB

          MD5

          564bb0373067e1785cba7e4c24aab4bf

          SHA1

          7c9416a01d821b10b2eef97b80899d24014d6fc1

          SHA256

          7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

          SHA512

          22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472