435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 08:02

Target

$SYSDIR/Codecs/CleanUp_x64.exe
Size

59KB
MD5

8fccce59080b31b379a9455fcb6a2d5c
SHA1

82c237910edd7df6c76b1d84bee9c667aa03356d
SHA256

e335b2aaf74356eeed90bd4117fb961115ad8ef94f03b9f0340cd46c12ced1c5
SHA512

27cb0ad805847f004ac6aee38e282cd640da4c82366a8818d18a8f1cc74ce901a684637463861095236fbff0febadd7d0017781dd09646ad4eafad9c07ca0707
SSDEEP

1536:08c2IoTp9pvPoZmE8d/XJLuCpC8KbCOD31HbioQ+UMH6Q+8iAKA:rc29Tp9pltdXJJp4bzr17+MJDKA

Score

4^/10

Loads dropped DLL 1 IoCs

Processes:

CleanUp_x64.exe

pid process

2188 CleanUp_x64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2188	CleanUp_x64.exe

C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\CleanUp_x64.exe
"C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\CleanUp_x64.exe"
1⤵
- Loads dropped DLL
PID:2188

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nso7706.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit