79551a4bc7453a47bf6ecabe218c80f7d8d57bb41a9900541d86d990b5cc8188

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d693786771814da1068d3422e659dcc4.exe
Size

631KB
MD5

d693786771814da1068d3422e659dcc4
SHA1

a04a3ba508faacd82f7a787722610ba83bb33805
SHA256

79551a4bc7453a47bf6ecabe218c80f7d8d57bb41a9900541d86d990b5cc8188
SHA512

b7e85b731fefeca6c9cbeccf2e32df5fd849acef3c63345a117b80eed2b6be1d7a3455ffd74e75d987491634e4db99e4d4f85cc1b8dd06681f77f7fb8413f187
SSDEEP

12288:ynMPoeOAiL2UhOZ3dPwRnpGxabI1NOrwM1qVEW81XFmHfa:mMPoesL2UU3NusxabI1NOrnTW898a

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2040	d693786771814da1068d3422e659dcc4.exe
2040	d693786771814da1068d3422e659dcc4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d693786771814da1068d3422e659dcc4.exe
"C:\Users\Admin\AppData\Local\Temp\d693786771814da1068d3422e659dcc4.exe"
1⤵
- Loads dropped DLL
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso100A.tmp\CommonFuncDll.dll

Filesize
304KB

MD5
34e9313d06cec5f78380b842c2da5dca

SHA1
d927d52d3f790d1be5f2405455880a402387216f

SHA256
6e515ae37d718938b7d020a69bd3a1e01bf5228cfcd1ccd0de3afbf5803c0632

SHA512
c3f79ba3a896de5ba128415a102adf2a58ca3906037006a839c4c1bc40a61b4e7a3a85c137c870dea4e1d24ee6a43f0e5cd0abc8a12ceef9f71915d5fa3dd3b2

Download Submit
\Users\Admin\AppData\Local\Temp\nso100A.tmp\System.dll

Filesize
17KB

MD5
f15530cf7d0c2cb5eb7cbe39546791a7

SHA1
d0b90675f6988c88718ee3663bab6765eb797d2c

SHA256
0279f2474ef4df4e4bd52f959c20418f28f7191119b8344f0087656223bc4c8f

SHA512
11a04930e74e6d23c1e022ef4d20fd465a8b49919ce60f249f2ad32f4eec73b91b5f2ea8a53a5a57bb2f9c8b48c09417017c32da4d10dcd1ae6c78f7b42cde1e

Download Submit