afaa8a729955493cbe50a2faba52c79c0f028a5e0b522f13ca3807be71d0c808

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd939a3d53e0d03da8e7e377141d9608.exe
Size

2.4MB
MD5

bd939a3d53e0d03da8e7e377141d9608
SHA1

5b98c72c79c7587b9760bda31aa6d4849d6224fd
SHA256

afaa8a729955493cbe50a2faba52c79c0f028a5e0b522f13ca3807be71d0c808
SHA512

bf0a100b15e032b8cd6bf0cc57c462077eeb0f01cd63eeee3af0bea5ae8f1857957cdb3fb7825394688ce30b5f6b6f0248a5835dbaf65ae06c5905e1967c157c
SSDEEP

49152:LZohMAIJdxck3egSGTCNcaYC3/1VnE82elDFxd+SEZp+:LgMbnrugSMCNcaYALEHelDFnxm+

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2208	bd939a3d53e0d03da8e7e377141d9608.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	bd939a3d53e0d03da8e7e377141d9608.exe

C:\Users\Admin\AppData\Local\Temp\bd939a3d53e0d03da8e7e377141d9608.exe
"C:\Users\Admin\AppData\Local\Temp\bd939a3d53e0d03da8e7e377141d9608.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso68B3.tmp\ioSpecial.ini

Filesize
686B

MD5
7268f81a3c51fe77b0bfda3d1f0ef2a9

SHA1
a16839a5f9ef1c2a6f3cd83766af1bdc0dde12aa

SHA256
f3f85f109c72a0dd7037d25a5502f1250e12f1ab708fb19bac0ab21dccdf6a2a

SHA512
6823e35d1c4be8cc53b40037186841588feb2143bac1d596bf44b3932200bcbb54c182eec9c01d087f15983bcf6ffeec2a674331d49c62b5336ed77eb1e28bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso68B3.tmp\ioSpecial.ini

Filesize
386B

MD5
f0de8380f771420311c2ddeb3b913626

SHA1
797c5cf2940119b1ee2dec08b16de56745ed8138

SHA256
08f1143df76bd829f3448d83b0f85442fc9da462a1ded6d45ee8efe94512d4f8

SHA512
c3cffe9ed5521546bbeaba590ace1a0e0eb8e34730b56460dea48c2ccb9bd3b191727510d020581bad4f35399dd390f3cef99d11dbf4adf7edfb91168939b765

Download Submit
\Users\Admin\AppData\Local\Temp\nso68B3.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit