Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 16:08

General

  • Target

    MainInstaller.exe

  • Size

    531KB

  • MD5

    9ce448dcd7cf13dd950725957361bdff

  • SHA1

    5831ff31825ea82d90a2989e0fc0a33b859d5f97

  • SHA256

    3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80

  • SHA512

    b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f

  • SSDEEP

    12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy16FB.tmp\ioSpecial.ini

    Filesize

    694B

    MD5

    2e6b7323e40dc59b8d13b4d6ee9e08e1

    SHA1

    a1d2be0eb5d43c9d8725c36f7ad205d96717d4ee

    SHA256

    732494eb31f29a7dfc75e9c6d94c2e6994e4e433966af488eb6ad58c6fd7944a

    SHA512

    086de294cfd7943d3681528fe031de1d391bbd2a48d9b61ab41f2c013fc9cd02a0cad99a49d16158d26751db84a94fd55a27335f9522c1719e288c53b571b140

  • C:\Users\Admin\AppData\Local\Temp\nsy16FB.tmp\ioSpecial.ini

    Filesize

    707B

    MD5

    0042762065d3d41d09ab001d7f404114

    SHA1

    591576eec974bb2e5f40f885507620c2dc46bf67

    SHA256

    af689a325c461ba10ff76d207f7069032bc385039e99b8d12c850347d61c9111

    SHA512

    f8c8e3e4efb3eca82a1cde6dc844859a8135f238068bbc7ad7388aaf07a5396a5a8f152f91f676dec87a92c7f41a95bcf7031cac39723167a05431f595e45f8c

  • \Users\Admin\AppData\Local\Temp\Setup.exe

    Filesize

    505KB

    MD5

    5d8d0c08384ad73216d52a2eabc064f5

    SHA1

    0fa5c77fd6b6323b926c9648679e063d1bbc8bcc

    SHA256

    30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce

    SHA512

    42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57

  • \Users\Admin\AppData\Local\Temp\nsy16FB.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf