2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe
Size

43.1MB
MD5

c75b5515952ea615219e1991c4592236
SHA1

2ade0a6c621b36f727e461059c3cdf2126d4bfca
SHA256

2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584
SHA512

65686328dc3ccec012871be9a1dcdc0aee0b0337ddf2ceeb689c4427a7a626091153a296a24ff4108dcca4e6247c2505e9375057172c56584f75dc82de4acb61
SSDEEP

786432:fV/UMe6yXkT3cCJ8FI5G4FtOOVPILJ8G+WwwlavmeeOEcI0wP0XECxgejlot:fVsMgXB2wpO1ILCTwlavmdOTLUCxLot

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe

pid	process
2420	2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe
2420	2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe

pid process

2420 2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe

C:\Users\Admin\AppData\Local\Temp\2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe
"C:\Users\Admin\AppData\Local\Temp\2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2420

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy17E5.tmp\ioSpecial.ini
Filesize
607B

MD5
ad527f217a36197f374d89cbba80cb7d

SHA1
ae98d3544a437b19e29c7e215d2837fff3cdbea3

SHA256
9203bc44384d939fb6cf708db4741bdefdf63ff4bdd1b9bddaef9b63bbbbb918

SHA512
9e282a5d0d8b51462278dc01683d03fb77d961de3f8d9bc952b94336d798d311df58e8f3e9af6baf65c022d715ee8c5d390f63a039a0c28591c44af1ea4aeefe

Download Submit
\Users\Admin\AppData\Local\Temp\nsy17E5.tmp\InstallOptions.dll
Filesize
14KB

MD5
5f35212d7e90ee622b10be39b09bd270

SHA1
c4bc9593902adf6daaef37e456dc6100d50d0925

SHA256
31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d

SHA512
7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy17E5.tmp\System.dll
Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit