53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:30

Target

53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe
Size

573KB
MD5

b07b3994ad66a39937d9081eb64cd5f5
SHA1

3fffe0fb2721f440909f99c5cb74d1d556ac45bb
SHA256

53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f
SHA512

43c7d08528c57467054c69c7d2b007662f618604abb465d92b1118dff290d0cb0bc8b2458ef35ae93fbc4d4b2f5527c298c350fc7743a21eacd548bd5f02d6e5
SSDEEP

6144:KcBvWsKG0/FZuK1JnKr4AlEhZmqUH1o0TLIaGWDwiyPAw9RyJqIZRSNQABuX+rVy:nKFZ1exehZmNHKyrwLpaJlZrf+r0

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

pid process

4964 53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

pid	process
4964	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

Drops file in Program Files directory 4 IoCs

Processes:

53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Telepatisk.ini	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe
File opened for modification	C:\Program Files (x86)\Fertiliseringerne\imperceptibly.ini	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe
File opened for modification	C:\Program Files (x86)\reliable\aldersbestemmelse.ini	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe
File opened for modification	C:\Program Files (x86)\Common Files\besvimelses.str	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

Drops file in Windows directory 2 IoCs

Processes:

53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

description	ioc	process
File opened for modification	C:\Windows\ingvardts.Sin	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe
File opened for modification	C:\Windows\tasselling\sporvognsskinne.Rev	53501f12261fc6003fb771379846bfc0bad23e331f0ccde984c431c22901881f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3380

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nss7174.tmp\System.dll
Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit