23c2e90c6f77374c216e9cbbe9fad20aa029454af4e7b203fcc39a09eac72e8d

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d7ab3520db4e3e51111a16b86bc46b70.exe
Size

61KB
MD5

d7ab3520db4e3e51111a16b86bc46b70
SHA1

406cac5b9d6aae4bb72a06ffb4f6f70ebce9a9fa
SHA256

23c2e90c6f77374c216e9cbbe9fad20aa029454af4e7b203fcc39a09eac72e8d
SHA512

e48d9be1acc80f61ebe142327c97f8082f12f90143548e3b9ab924a37e1d99cabe43bfbf09ddfddd0386cf5bcf21a34354ac0d73d2ff1d08e30c934a04add109
SSDEEP

768:w1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJ15J0YFdz0sL6YdrRP69tkuwhZx:uQpQ5EP0ijnRTXJ15CMdY/YtQtRIx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2860	d7ab3520db4e3e51111a16b86bc46b70.exe
2860	d7ab3520db4e3e51111a16b86bc46b70.exe
2860	d7ab3520db4e3e51111a16b86bc46b70.exe
2860	d7ab3520db4e3e51111a16b86bc46b70.exe
2860	d7ab3520db4e3e51111a16b86bc46b70.exe
2860	d7ab3520db4e3e51111a16b86bc46b70.exe
2860	d7ab3520db4e3e51111a16b86bc46b70.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop	d7ab3520db4e3e51111a16b86bc46b70.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\d7ab3520db4e3e51111a16b86bc46b70.exe
"C:\Users\Admin\AppData\Local\Temp\d7ab3520db4e3e51111a16b86bc46b70.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4428 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl6236.tmp\inetc.dll

Filesize
21KB

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl6236.tmp\registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit