2151c2922997e073ebe1d7926f08cd1b32f3cec9c30acea15e5ffd63d2e54796

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 1.5MB
Sample240315-wscc9afd2z
SHA256 0ff0657b347d1dad5c8521e79d4e94e9a4f3b3a20fb069be8d812842099227db
MD5 42f035cd1ebe0f24203f66d2c52128dc
SHA1 0285bdbe714017349d8b7f9a684ec02627c21dff
SHA512 affbcb3ea968d3935042c5652721b8fd1c8d76b880f3b23a6505b7abc73b6310d969e1c733f4759c0df83158ef0b14c0d3eaf614c06cac39ee7007ae92483789
SSDEEP 49152:P52T4oe4h+1vN051NqZklJq3s0ZpZLTfxUq17qY6I:P5E4oHh+R2RYz3s0lZZ1G/I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1564	Install.exe
1564	Install.exe
1564	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1564	Install.exe

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd4EDC.tmp\ioSpecial.ini
Size 630B
SHA256 146481c29f7b491b1077fa5073582abbf613444c7c66612dd8a16f3146435616
MD5 ac6a3546483e010488ad6fb38ed39626
SHA1 caf6ede2e69c883e5b3a5a337f7447554b6552dd
SHA512 aab239a288da5cdc3178b9d10f398f4349b7467b4a3b7713298844bfb441e2a0d575184efbc66c1eeb51eab9b0f3109736ceeaa494606822e059be7e16571772
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nsd4EDC.tmp\InstallOptions.dll
Size 14KB
SHA256 426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
MD5 3809b1424d53ccb427c88cabab8b5f94
SHA1 bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e
SHA512 626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee
SSDEEP 192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT7K72dwF7dBdcQOz:i6JaVh4I5rpPbT7+BdhO
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsd4EDC.tmp\System.dll
Size 10KB
SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
MD5 32465a07028b927b22c38e642c2cb836
SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads