8daf2a0088faa54e2c2720af17559507bc68e318b080176895bdcb22edf01d5c

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 09:07

Target

masScan_1.6/WinPcap_4_1_3.exe
Size

893KB
MD5

a11a2f0cfe6d0b4c50945989db6360cd
SHA1

e2516fcd1573e70334c8f50bee5241cdfdf48a00
SHA256

fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de
SHA512

2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70
SSDEEP

24576:UBOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqiL:2KzqWsayROxa6QDENuaG+ifL

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

WinPcap_4_1_3.exe

pid process

5020 WinPcap_4_1_3.exe
5020 WinPcap_4_1_3.exe
5020 WinPcap_4_1_3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\masScan_1.6\WinPcap_4_1_3.exe
"C:\Users\Admin\AppData\Local\Temp\masScan_1.6\WinPcap_4_1_3.exe"
1⤵
- Loads dropped DLL
PID:5020

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nst4298.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst4298.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst4298.tmp\ioSpecial.ini

Filesize
578B

MD5
0131e2f1f0fac64388e95925240577b0

SHA1
1e55cfb0b8aa8202cae57bc60ec508d7cd20b12d

SHA256
97b76cd050bf1839535a9691bd0b4da362e8367e8a7a154b6830ea58c601a380

SHA512
d918d3fcc5faf67f6e4ab2db46e21e5aff383ddf354e93683b5689fefa2c19e9aad117785e350e64ce5cec2ca9a27a705f82462024a41ae70f39e69c14d88fd4

Download Submit