acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HAB910_v1.4_230413.exe
Size

32.1MB
MD5

bb39a9e910c509b15109bad6f07a0812
SHA1

0fc45d5b4fd6e96ac3a66317d8903892d7c97deb
SHA256

acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634
SHA512

3b31bb66201b1aacd763fa574d66ae25a32d9f1c60d77188bfdb852256e0b7689ec9aa0909520f983123af9b1818a4f6892fb842e8d27d581e954df710fed946
SSDEEP

393216:u/gE/XyOav5Gj8CWSNs7Jhppvq3sYXXujTD7+z5R+EtFvTHhCfmdH1t/zRQk3Zbm:u/1fav5GI/SwJvpvq6SzV/hzXRwmPFQl

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3496	HAB910_v1.4_230413.exe
3496	HAB910_v1.4_230413.exe
3496	HAB910_v1.4_230413.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\HAB910_v1.4_230413.exe
"C:\Users\Admin\AppData\Local\Temp\HAB910_v1.4_230413.exe"
1⤵
- Loads dropped DLL
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsn422A.tmp\StartMenu.dll

Filesize
7KB

MD5
c275bc6ee70d85aebc2328c06515a2a2

SHA1
0f12e4736eff8f1a1a4c467e2f52eba2dac4e7e6

SHA256
30336c7b09582de438d6c3f561f55366dd7094faf24f34e12df44acf19be9242

SHA512
aeff89ebf093555aeaaa15f86e519523266b08e814578540430b3f2b67c6ad92a8e0072716f8ab80e6afc9a160a7bbaab0800b372107613d78793a9fd0fb9240

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn422A.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn422A.tmp\nsDialogs.dll

Filesize
9KB

MD5
eac1c3707970fe7c71b2d760c34763fa

SHA1
f275e659ad7798994361f6ccb1481050aba30ff8

SHA256
062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3

SHA512
3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09

Download Submit