35bcbe83559ef07628aeb933f9c556b3a091ac996fb35508a482e3cd367d6a18

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cool-3gp-converter-gb.exe
Size 5.4MB
Sample240228-qlrayace5w
SHA256 2dd8ab6eeb9b1da1ffe24d763f3283a69915d99b9e99d63f4214bcab2694aaa0
MD5 e73abbe223d122136c1042818ea3e7da
SHA1 de162d707530813007667fc432a55760bf8cac9b
SHA512 1113d9bd6685aaa59fc879cc63b3cb828516c7b9275082e37b6534a4bc39fd78f7c9d3e072a358d299436e100ace73cf49c5bb34ea4a51c9704169599f4222a2
SSDEEP 98304:/LckRG2E5JsqnEyWAN5wiloBNhgI4qco5OhFEKgjHnk3iBITDyTVqxEksUahGQIa:/LckRNQJVbYv4qN5OvEnjHOiCH65UsGg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1288	cool-3gp-converter-gb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	cool-3gp-converter-gb.exe

C:\Users\Admin\AppData\Local\Temp\cool-3gp-converter-gb.exe
"C:\Users\Admin\AppData\Local\Temp\cool-3gp-converter-gb.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd8650.tmp\ioSpecial.ini
Size 599B
SHA256 c115864fb9a616c96d5bde5ce5d5fcde8fa3072efb33744eeeb2967573136e0d
MD5 795d055d4df90735aa4f8ac6e31ea7a9
SHA1 fe24b9f2018719d8f4d736262a2bfc4846eee0cc
SHA512 a20bec38e24c30b0f6b97e79589433f609b520cd6b8ad94c4b15e0d19870ed3b4ae038f09b7032728608742caacf430b9506690a45186686976e46aedd25bf64
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nsd8650.tmp\InstallOptions.dll
Size 14KB
SHA256 44c822afaa4cc7cb95390eaa0ada076d280d3455870569f0cde03637257d9899
MD5 0285eac59530ff5cc91fe2634b4ed78e
SHA1 241c12aefca0740e776362f30aa1edffd66d6bdc
SHA512 1007fbfb82d4e6c04bd5fefb32cd81f4406022ceef4d409eda0f0ddeb8b1f124a2baec86498bc119778e0c241fc41b0c2440d8a8f6731a63ede936be94f81297
SSDEEP 192:8nK6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTgK72dwF7dBEnbok:8K6UdHXcIiY535zBtMTg+BEnbo
MD5 SHA1 SHA512 SSDEEP