Analysis

  • max time kernel
    122s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-03-2024 16:25

General

  • Target

    MainInstallerAutoEmbedded.exe

  • Size

    796KB

  • MD5

    7fc6bc14a74dc69773587af10132d8c9

  • SHA1

    9d98b268eaa7f4ad208bde39944fdb1ab201e076

  • SHA256

    e288d49f6011dcd3f893e54ceafda9b6b491543966521c483064a7df43e5bdd2

  • SHA512

    a738205fb26bf259e70b1cacfd10f9168d381778ef90a49847b8d332d93b471cbdcf6357a3d2dfb2e41a4666cba98dd9dc2867a20d472636e5fc8080cc073742

  • SSDEEP

    24576:P7yrmq17YLUAl1+O50aT+1bXkS/EZQM7G7ZQ51bmtfWR163i95cVmB:jgbyLV1ILT/ES46S5Bmted6VmB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe
    "C:\Users\Admin\AppData\Local\Temp\MainInstallerAutoEmbedded.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
      C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy64AD.tmp\ioSpecial.ini

    Filesize

    694B

    MD5

    af834e2a3219676b8f9783ddcc699699

    SHA1

    6d0f5b570f8472315f21d74afc0643341bb9b1a1

    SHA256

    49a55fde5a8e088cbaf3e2d40b1d9d93669336bec3bd326769b878487133f8b8

    SHA512

    61e43f9eccd0a6f0556abd79a31097391016db45fd1c3e76998aeaa235c0e37f98d356544e68b77a665c0715b0d58ec057a8e9cb411754f0f1ab8fc806bd0fdc

  • C:\Users\Admin\AppData\Local\Temp\nsy64AD.tmp\ioSpecial.ini

    Filesize

    707B

    MD5

    24edced680d4cf2668217abb9b17bb53

    SHA1

    51d1dece4cdd1af5082a02fc2b2d73c7b9edc588

    SHA256

    3f33a902db18285ff4740f993c97b265f7833f01b49e8bfdfb015cdce17d2001

    SHA512

    ea6c59daa98c939bd1c234a913086f2fe36775cf04a22a765342ecae4d12e842dc37bb2507ef4cc4bfa52200b7c8a261f0112a21bc776b47a44dea6638996f73

  • \Users\Admin\AppData\Local\Temp\SetupAuto.exe

    Filesize

    512KB

    MD5

    ff0198fd1f59b71c1deec34b6b0b0c07

    SHA1

    cae622ad91a3bab0996589e3bf905c9d4eeb6059

    SHA256

    f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5

    SHA512

    96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc

  • \Users\Admin\AppData\Local\Temp\nst6308.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nsy64AD.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf