965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b

Analysis

max time kernel
151s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.5MB
MD5

0878e6d9ef048ec2fa1242f41efcbd23
SHA1

df2eec2f03a400d6af63083ff87554ccbb4b7c1c
SHA256

3b85494d6061fd5776aaebe6ed3d9279db2e54b32d2732cf7d0142fe625f5668
SHA512

55197a346c3a0d17fb69425b3f263a7f20c21a00868f509a79170b7ff20d3ad7625b4ee79a8af8f0f3182c34034b008d50a07a2b98566720a72f318f0e531611
SSDEEP

24576:2dxGJlyasqigby7xut7UgXxGzsHtRxGDRGCs6MaPJ+M6+dhp5l9TfgSodpkLlDu9:iwyasqtYxC4gBGzqGDse54M6u5nmrkLE

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1704	setup.exe
1704	setup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1704-8-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1704-85-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1704	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi52F1.tmp\ioSpecial.ini

Filesize
692B

MD5
5d3fffc398913ab36ea841d0c1752590

SHA1
187652517c8d6e362300f1ebdf1e666e349a18c8

SHA256
1811b453ad573aaeee0458fc447a312a37c3cec9659de462136d40ddd133d5d6

SHA512
4abe1b5f1ff0d490f8941aed60f9f774f503bcbe9ad41947aba2ef722f5fd33084de2eae9e6cedbe24ebae69487a5830c5c122ead40628a28111806f78431a9a

Download Submit
\Users\Admin\AppData\Local\Temp\nsi52F1.tmp\InstallOptions.dll

Filesize
12KB

MD5
43ba71f370a45aebcde86d76b83b208c

SHA1
1f14e3c253a5b7255b617084b45e51ef9d6717e4

SHA256
6d0a19614efb523f78477429df04b71459ee69b3d16231798dcfa539b3d2a64c

SHA512
36aaf1ccb7c1085ba9fbacbad6c1505c9e389be5e9bd52ee7046b48302b8239d6e34dfeeb32a2708c4fb7d5a85c1d202fbdabcdd6a2cced0099249640443b551

Download Submit
\Users\Admin\AppData\Local\Temp\nsi52F1.tmp\LangDLL.dll

Filesize
5KB

MD5
4551aee5b604f7a4fdeb95dc1364adaa

SHA1
e6aa9b8072351b098a6b777616f4e949051dfc01

SHA256
e90123bb975b4d9a79efcf9e84f849d9de1c9a564f62197092e7f7ad718578d3

SHA512
0be8829d33af093b9bc6b5d6ee1506656b9fe513f518e1922804e93b59e3c5832f8ae78fa79fb095da5630765949af812cd7d88e2b42daed0150e5798abc9445

Download Submit
memory/1704-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1704-1-0x00000000002C0000-0x00000000002FB000-memory.dmp

Filesize
236KB

Download
memory/1704-2-0x00000000002C0000-0x00000000002FB000-memory.dmp

Filesize
236KB

Download
memory/1704-8-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1704-85-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1704-87-0x00000000002C0000-0x00000000002FB000-memory.dmp

Filesize
236KB

Download
memory/1704-86-0x00000000002C0000-0x00000000002FB000-memory.dmp

Filesize
236KB

Download