04df4d095a36105942be8be5c147948a99581b6f09c4d17c3e69345a4f2905f7

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb63f8372394ec1a4a9a51985d14326e.exe
Size

23.6MB
MD5

bb63f8372394ec1a4a9a51985d14326e
SHA1

3fb6883687d99d87f6ec190e1e7965e47dbf4950
SHA256

04df4d095a36105942be8be5c147948a99581b6f09c4d17c3e69345a4f2905f7
SHA512

a935d8b1dcc3f689f72c80109efe45b7dc784e21e46fc291bf880cd17388c45501c4099ad84a40cba41afc5afb7e34633a2d44ffd17aac168e9937d8b7a69f4e
SSDEEP

393216:14OnYNAwDDyMTtOQxxuDm4puKT+MWAk4BDmJONvlo3ofrzRUt3f9SNu8q8i:+OYAwjtOVDHTBk4BKi6YTzRfNxTi

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

bb63f8372394ec1a4a9a51985d14326e.exe

pid process

2332 bb63f8372394ec1a4a9a51985d14326e.exe
2332 bb63f8372394ec1a4a9a51985d14326e.exe
2332 bb63f8372394ec1a4a9a51985d14326e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bb63f8372394ec1a4a9a51985d14326e.exe

pid process

2332 bb63f8372394ec1a4a9a51985d14326e.exe

pid	process
2332	bb63f8372394ec1a4a9a51985d14326e.exe
2332	bb63f8372394ec1a4a9a51985d14326e.exe
2332	bb63f8372394ec1a4a9a51985d14326e.exe

pid	process
2332	bb63f8372394ec1a4a9a51985d14326e.exe

C:\Users\Admin\AppData\Local\Temp\bb63f8372394ec1a4a9a51985d14326e.exe
"C:\Users\Admin\AppData\Local\Temp\bb63f8372394ec1a4a9a51985d14326e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst7070.tmp\ioSpecial.ini

Filesize
829B

MD5
0f33ed82d31f33d46627df7516fe8cf8

SHA1
02f77a4ab7790dd934c459c1f55df8cbb3f65e43

SHA256
770f2a39e1a2e1dcc23f1ca527a363123d49466638c2ea81bc8b9b51ffac890a

SHA512
3f2c318eb24e3e5924f019756738f9661762d842fd569d384af6423f627258175fc3f71adb952756bbd4f0a5389dadc6713bed0289649d7a85ee67af5a2fc096

Download Submit
\Users\Admin\AppData\Local\Temp\nst7070.tmp\InstallOptions.dll

Filesize
14KB

MD5
20f3184efe7edddfef3325efc25d12a5

SHA1
8db4c500d73f9525a7e9834df6caea2e70189939

SHA256
0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

SHA512
433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

Download Submit
\Users\Admin\AppData\Local\Temp\nst7070.tmp\LangDLL.dll

Filesize
5KB

MD5
ea60c7bd5edd6048601729bd31362c16

SHA1
6e6919d969eb61a141595014395b6c3f44139073

SHA256
4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

SHA512
f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

Download Submit
\Users\Admin\AppData\Local\Temp\nst7070.tmp\advsplash.dll

Filesize
5KB

MD5
669030d7919ae29999a2fd89aa427202

SHA1
870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

SHA256
e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

SHA512
1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

Download Submit