ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd

Analysis

max time kernel
66s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

google_setup_S2105150849_.exe
Size

16.0MB
MD5

655c33920fd920dc86fe9c572f1bbaba
SHA1

766af67dd9d609c1cbf56578f25b0a3bacc580e2
SHA256

ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd
SHA512

e8e29eb2e9d26122d59b806a3bb7047b61f36942f34c0c883394337dc86896f71bf0cea4951525387c1eb9511624453022a0aa7e852882bbba7271c1dc2448fe
SSDEEP

393216:fuIjTX0c+rk9t2+arEhxiLFbHO1mmailtTZ0h6xZ:fuIjYcgPdHcmmaGtTZ0hC

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3272	google_setup_S2105150849_.exe
3272	google_setup_S2105150849_.exe
3272	google_setup_S2105150849_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	google_setup_S2105150849_.exe

C:\Users\Admin\AppData\Local\Temp\google_setup_S2105150849_.exe
"C:\Users\Admin\AppData\Local\Temp\google_setup_S2105150849_.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj43E1.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj43E1.tmp\nsDialogs.dll

Filesize
9KB

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit
C:\Users\Admin\AppData\Local\Temp\setuphlpr.dll

Filesize
264KB

MD5
5b8659339fb6f998f25f3d7055b90a8c

SHA1
f28ec774744fbd6e2fc9f594bd4d31ef2adb8276

SHA256
c9bfcea372292fbd29f5a5f6cb51f97143d80e036133830fcb74f0994de51050

SHA512
37515fee58d2b2df3f3e9d270ec9d4f83f49333411a41c5a7d0514a5745c747ea5d79de2bffc543a2d54124ac49476805d99c18dc9ec0550be538eb9ecac3d99

Download Submit