ece8a18ca4213a95ef9b7d6f9bf18b81572c159cf2c7a836d70e2716cc7253da

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Danger/nmap.exe
Size 27.8MB
Sample240302-pwl9asde86
SHA256 f1160a33fb79c764cdc4c023fa700054ae2945ed91880e37348a17c010ca716f
MD5 f9e753cccea0ffae6871dc65f67d3f89
SHA1 ab2de49f90330cc3b305457a9a0f897f296e95f4
SHA512 0c6f6c14ecf8ef028e6a556f58e720321a7808b0a1f602e019f6b21d9cef970424185c27e7647368d2fca256d47844310d76d626209d406a961d048063410d1d
SSDEEP 786432:eCw4jIIk4AN6o6JWCRCLz4NFMqt9+26UgRY5YYnDEWW:e/T4hJZRCgMkg+5HEv
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2852	nmap.exe
2852	nmap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	nmap.exe

C:\Users\Admin\AppData\Local\Temp\Danger\nmap.exe
"C:\Users\Admin\AppData\Local\Temp\Danger\nmap.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nst4923.tmp\InstallOptions.dll
Size 22KB
SHA256 dbb0173bb09d64ca716b3fd9efb0222ecc7c13c11978d29f2b61cf550bcd7aba
MD5 17c877fec39fc8ce03b7f012ef25211f
SHA1 61adfa25cbd51375f0355aa9b895e1dc28389e19
SHA512 45c44c91bf72d058fcba93e7d96b45fcc3dc06855b86eca0f463aa4eeafc7e68493e33663c68fd3fdceed51dd0e76d3493c47da68a3efdc25af9e78c2643d29d
SSDEEP 384:ENC43tPegZ3eBaRwCPOYY7nNYXCg/YosaGqZmZsHLOtNUShHzer:EETgZ3eBTCmrnNAow1OThHzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download