Analysis

  • max time kernel
    122s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-03-2024 16:55

General

  • Target

    Setup.exe

  • Size

    505KB

  • MD5

    5d8d0c08384ad73216d52a2eabc064f5

  • SHA1

    0fa5c77fd6b6323b926c9648679e063d1bbc8bcc

  • SHA256

    30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce

  • SHA512

    42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57

  • SSDEEP

    12288:6xPm2P17YJbq9VXMLVS+n78L6OdBRdrrf3xr5Uw1jcZQM7gMyZQU:6Jh17YYVV+YGsBH3xr5Uw1jcZQM71yZX

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst90BC.tmp\ioSpecial.ini

    Filesize

    707B

    MD5

    2318d43807606321aa3e7cf6dd263e35

    SHA1

    a5431c9040ec03db8f3af0efbfd1a2d38c797af4

    SHA256

    36fca118fe363cad345f0ba7a3e393f65d049ca38c5a3fecd75a343a4e5ab4c4

    SHA512

    4993d2c14c927fc5709fca04dd0ccf5ce03d8c81d34c826ef04bd8746962868db9cecc7c442518d7284e006b51bfc0473dfbef72a59c88c45c9d1bd5251f4756

  • C:\Users\Admin\AppData\Local\Temp\nst90BC.tmp\ioSpecial.ini

    Filesize

    694B

    MD5

    e433a77e72f45425407cd6e4a6886d19

    SHA1

    1491654465be916e02b81c9aec916acee27f8f51

    SHA256

    c45652f704dd628d4142aced8cc2f4274dab88b9c573d4086bf51599fcc6297b

    SHA512

    47423328092f951ac4247b134d18da4c0c8a165d513c5a66c33ec1e4cd4dff4caded1a42be190cdd6bd7003ffd489d34c731aa0516cc787cb0044a1f32b59ccd

  • \Users\Admin\AppData\Local\Temp\nst90BC.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf