7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
Size

35.0MB
MD5

af7abbbc2a5949f8b21c8efaaf68ee0c
SHA1

65860db5f44133770a8340d537dd9af6755cd955
SHA256

7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22
SHA512

632e3e7a59fa8e3e4dd784472ad2db1e52686d6a570d8b75fb072a088d91065757ba25d59a9970cabea51593c17402d6c5a6d635bcb4f7246cff86fb53663455
SSDEEP

786432:OI2HW0tLW3Xz4eEgs3aA5Mx0K7a8o1NP/0oNEsNnk7KL4WOZn0ztJHhhpVz:p6reEgs3aA5Mx6NVNEsNnkoSZ0zrP/z

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 30 IoCs

pid	Process
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1664	7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe

C:\Users\Admin\AppData\Local\Temp\7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
"C:\Users\Admin\AppData\Local\Temp\7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB268.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\AdvSplash.dll

Filesize
5KB

MD5
4c2048fab3e88d65b1186de260751d1b

SHA1
a586394a689652f1f803c40e564af459140f530a

SHA256
b08d6797848ee8eef5393391a7318e10720d55d03c910a2127c03b074c4966af

SHA512
cfc39b9a96f0df06e50d7560557b8fd86ce22860a4d7a7e9562abdbd2503c33fed8595e04ce55f45181f2b7c4d1a421713cfeeee3c6d8b56be4d0aec7fd81777

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\MoreInfo.dll

Filesize
7KB

MD5
bd393029cc49b415b6c9aeb8a4936516

SHA1
c67fd92fffd18941bed41bfd6ac4f3b04fd123df

SHA256
227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026

SHA512
3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\nsis7z.dll

Filesize
169KB

MD5
567103638bb0c81cf9bd86f727ea12ac

SHA1
ddc03ea66412f11b5975092f92067a85d29d17b1

SHA256
37dd96230521a91dc7eba0d0a4fe8726b4405562b1a96363a01e28334bde94fd

SHA512
1d64a197489ea45e21a89ec535ca0282eed47ade40589dee31de865870ddb91ffc0921a5eacea89ddf9bc1d9b93bb7edf6f6c3148a18a9611df87be0fc369fa4

Download Submit
\Users\Admin\AppData\Local\Temp\nst932D.tmp\nxs.dll

Filesize
6KB

MD5
725a694a4711245e8ec2beafbbb60d2a

SHA1
f7b548df9469faac87c68ac020b32985c62d4e0f

SHA256
ee9da9fad0ae660326395e1d5c293838253389f4939d6216aab945e0228fecab

SHA512
88cd491084fdc23eb604422931d0285aa015f52f877d53099211edc3c4905b59a33fecdd9efb41b77b396aa84e59638479333692bf1ac2f93936a0ffac75d49d

Download Submit
memory/1664-104-0x000000000D1E0000-0x000000000D211000-memory.dmp

Filesize
196KB

Download