24fe65718394b79c9d647247a56788d65b3027391ab9f09484705b1d57635818

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 21:03

Target

LUXONIX Purity VSTi.v1.2.4.exe
Size

51.8MB
MD5

00fc9eb69c94289d9d6ca90db5eb5e3f
SHA1

41299831b2aeb1feb460b2bfc7b40e5c42a0fafa
SHA256

24fe65718394b79c9d647247a56788d65b3027391ab9f09484705b1d57635818
SHA512

428cdb4174592fe813861010e3846d29729053490cff0f16bb90e99bac6572a71aff69471cc9c77c77956b30155152d735c774130dcbd056276b0d5dfcb09777
SSDEEP

786432:+I/s4XCJrQXhuHnYvw6rbMtmHcZ3oiqB6hyGBC3Ig4UTKVgEWkoG6ef3+z:+ID2EXIHhCQo8FoiAZ4UuVgEW/GI

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

LUXONIX Purity VSTi.v1.2.4.exe

pid process

1524 LUXONIX Purity VSTi.v1.2.4.exe
1524 LUXONIX Purity VSTi.v1.2.4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1524	LUXONIX Purity VSTi.v1.2.4.exe
1524	LUXONIX Purity VSTi.v1.2.4.exe

C:\Users\Admin\AppData\Local\Temp\LUXONIX Purity VSTi.v1.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\LUXONIX Purity VSTi.v1.2.4.exe"
1⤵
- Loads dropped DLL
PID:1524

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsm32C9.tmp\InstallOptions.dll
Filesize
14KB

MD5
271b5d1043c4402f08ddeae383f6979c

SHA1
2b88c58aa27bfb4979239579cd65d4c6c67a5295

SHA256
90485cb175686c3e97b32ebf99daa939c1a6f46e7031f71b72b81cd114fd5b51

SHA512
f8bd4b316726f05647162bb52a2aeb4a6cf5ee976fdb7817a3d25b868b83fb482c38d078f01d3a629afb0d6fa6ce409b2b3404398563137e22010074f529c11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm32C9.tmp\LangDLL.dll
Filesize
5KB

MD5
efc45bb93d44b05c9b4ab8f7ba367f34

SHA1
22aea2c2236532ecbe66f54d439e161eba2ca2ae

SHA256
d4192b8ed924e4a7706f36a411242392e5292e522698122ebb396dcc94e29750

SHA512
04ff1141e9d0114658d237657b988f800d254f15e5c7158d194c015b848d6b1997d5d2d0bebe366c33b772d2abe80678510f8d7f2aa76ebe06f49bc5011642db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm32C9.tmp\ioSpecial.ini
Filesize
710B

MD5
927613910e33ffa81e7eb35fda7fabc6

SHA1
e6c0d0a58bc278556371c672cdbe28f0477a54e0

SHA256
4ccb2f270a976938a92f7be424896e024329107b34d40ec181f0fa1d40285804

SHA512
7e5817de21106acd286a6f7b0a3e544c3d664fff8bb464f654c1b9a4b42879021710bc2beb7a9a29fbcf1713b8f3b5be8c8fdb781bd3fef99f6f8181db335f2e

Download Submit