42d165d91eb4e6994afb93300dec7e725a66b1594e5ff574e9f2584d287a210b

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec3b733bf1a940a8ae079f1161b9500.exe
Size

699KB
MD5

bec3b733bf1a940a8ae079f1161b9500
SHA1

1bf4f403621072bc58b693a8b7ee9a002aee2f5b
SHA256

42d165d91eb4e6994afb93300dec7e725a66b1594e5ff574e9f2584d287a210b
SHA512

2f0c411ec3af1903abf2171ab5090e1145837678271169e5a49757a380e5b2be2107f0b1c4f9ace60fb61c49995f391e106edb883ee9c43c1767d49028336ee6
SSDEEP

12288:pRtnqQHzV0SKwKAMQNffgt/Ju0YDLDHDKrxqYZQpZyo/R:pjnPHRZKwZfIlYvDW9dcyW

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2804	bec3b733bf1a940a8ae079f1161b9500.exe
2804	bec3b733bf1a940a8ae079f1161b9500.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	bec3b733bf1a940a8ae079f1161b9500.exe

C:\Users\Admin\AppData\Local\Temp\bec3b733bf1a940a8ae079f1161b9500.exe
"C:\Users\Admin\AppData\Local\Temp\bec3b733bf1a940a8ae079f1161b9500.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst7995.tmp\ioSpecial.ini

Filesize
750B

MD5
04bc6f8e7179f3ff7153fb0e9e1cd083

SHA1
9e880fe6b17d6a5ebf6e155b106afed02501063a

SHA256
f5a04fa51f62d3e20b859e5e7b0c8da62536f18b32bf840c80be30267eeafc28

SHA512
ed991f10fedbb0fa61cb4aabead47ea57dca3ddb2f0339cbf84a47db8b8bd749d6a2e5f527dce688f62664189809e29d9af4ef4acb4a125049efbab4b264d3ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst7995.tmp\ioSpecial.ini

Filesize
763B

MD5
c203435ef19a25b4f1d57795c25816e2

SHA1
45dab97410d139632246676ff2e6b7be6dfb50b4

SHA256
703e7b674c911e99bd59cded29140a15a69b3ce7bf68c9acfd317cc74ca0df8c

SHA512
5af2985d6b362b4824f486a31cdcb59bf8720bc901c6b8120f6294dace5938f8a3494baf432635f8b9666d6d4e3116405ac33181770ceab08146a6609bbd1477

Download Submit
\Users\Admin\AppData\Local\Temp\nst7995.tmp\InstallOptions.dll

Filesize
13KB

MD5
d765c492c21689e3d9d61634371fd861

SHA1
ac200933671ae52c9d5544d0e2e8e9144d286c83

SHA256
551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

SHA512
9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

Download Submit
\Users\Admin\AppData\Local\Temp\nst7995.tmp\System.dll

Filesize
10KB

MD5
fe24766ba314f620d57d0cf7339103c0

SHA1
8641545f03f03ff07485d6ec4d7b41cbb898c269

SHA256
802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

SHA512
60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

Download Submit