Analysis
- max time kernel
18s - max time network
16s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 21:46
Behavioral task
behavioral1
Sample
nasm-2.16.03-installer-x64.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
nasm-2.16.03-installer-x64.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
- Target nasm-2.16.03-installer-x64.exe
- Size 1.0MB
- Sample240613-1mlrys1eqf
- SHA256 657e1252676cfb26a008835c20a760f731c8e0414469a4ed0f83f0fb059cdd35
- MD5 4205b5973d293543e89c2069635117e3
- SHA1 1a67e9fe7605777a78096007600bfa1492ad0e9c
- SHA512 50e4b38098f468604b6b6d7873f4100b9305716c4946ce8092f94275e71c8905d36fb8b0c0096410c9ef33f5a93e92dfc68b08e1b59ad8be4b111c1e2546b14d
- SSDEEP 24576:VUFH8ebk9B82QVMbrNgW9ty9TwmEOIm+vz3GNVmyw2TLBcU48i69/83a:eFc78ZVMbZ3ydxE9jqoywCLBcUT7Ma
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 2024 nasm-2.16.03-installer-x64.exe 2024 nasm-2.16.03-installer-x64.exe 2024 nasm-2.16.03-installer-x64.exe 2024 nasm-2.16.03-installer-x64.exe 2024 nasm-2.16.03-installer-x64.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files\NASM\ndisasm.exe nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\VSrules\nasm.rules nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\LICENSE nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\nasm.exe nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\nasm.ico nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\nasmpath.bat nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\Uninstall.exe nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\nasmdoc.pdf nasm-2.16.03-installer-x64.exe File created C:\Program Files\NASM\VSrules\nasm.README nasm-2.16.03-installer-x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Program Files\NASM\Uninstall.exe
- Size 118KB
- SHA256 e94531c8677f86373377e55f55befca0c9becd084f48571db63a87ac154ed04f
- MD5 5daf94410f68f7ea5beda051c9f23054
- SHA1 ae734cf1d623a03fe510c434969743e806ba38d2
- SHA512 4bfca2c230fc92abb7db4cd4a6eb7c58a15daa1d5f7ead98096508ef19f626dc7691e59f54ab2a16ae5de364871c2298e40f9e06a10e1998f1aef1b7e55cfa2e
- SSDEEP 3072:kbON33/iniTqt1RT798xQT+5U5qSHAx22G3:j9a/ZB06gx224
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\NASM\nasm.exe
- Size 1.6MB
- SHA256 a93276636266516421cc9b422f47476c21f7a2949f1ae251556b2f1d33a3be04
- MD5 7a564fd688ae791e69c360c1cf54ad61
- SHA1 c0fa0e8f2416f8c99151dcebceba1bb2f3449409
- SHA512 f4b6e93f189787300bbc551465b49468809cc274d45d3452a5932c74cb1d5466b2491358b2c77f2334faa9dc271551bcf3b965b17e1edf3336d5fc78d4605465
- SSDEEP 12288:fMU3jSCdG1I2F1EsOm8hc4Jz41UcNWQity:0kESsODJzDm/ity
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso322A.tmp\StartMenu.dll
- Size 12KB
- SHA256 95218c916fd8514cfd7fc234d44a5b0930ca5c1c8dd133e0ad18127ce5ed1d8a
- MD5 ac238522827cff2c921d83c76dee76d4
- SHA1 ebb4f1f27943b9a47cf94957d4b6a58b2ebe789f
- SHA512 0f6301b74333aad58a0db469690085fc81a8d9d775d584d2964a33bbdf6b83bafe516f47ebc3908d4f266cde3eb620fcf901f31b9ee7d1197db94baf5885ede8
- SSDEEP 192:u1BTusyjbI05hbvNuw8Ykv/RjuE+lIP93/:cyA0DJuw8Ykvtd+lI13/
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso322A.tmp\UserInfo.dll
- Size 7KB
- SHA256 c224f7da273ee3815e462be08fff79b1435eb6e7733e3d4fea5bd95c9f4b1d26
- MD5 14526f5953a85912872802ae286a787a
- SHA1 ea5815e19b07b4e8f3e197e3f6358138e364f290
- SHA512 483ae7b8e462403f0f4bab367586f41a3ee5dea18d81da39b9c64eb1b89c8b9c78be547789fca4f26700a7a6c55bd65464737efe50dde6ef191e691ae8080d66
- SSDEEP 96:tH4EHQ+FgZHgpVGuRkNB/R37dO7neyK3gGam:1N+H/Ykv/RLdOzcQm
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso322A.tmp\nsDialogs.dll
- Size 14KB
- SHA256 2a637a57dfe1d492af5003c03feddf4de34c3e10537a849987efd3465aea59b1
- MD5 8e7a455526283d46300d394522e59f2b
- SHA1 182a511fec4806cc886ce3c8170648411ba841b8
- SHA512 3f57012aee8118d9d75b988b14a92191593c59a1c51a76569ff94232b25a5c3dc710f5fe4ccfb717ab32d48d51f0755543dc77e4cbabed68061ad18496126e38
- SSDEEP 192:klWWck581HwPRLG/CocFR1w5nEYkv/RGlOBoiL+6SZSM3CU:vdk5SoRLG/CocFR62Ykv8lOBoiyXyU
- MD5 SHA1 SHA512 SSDEEP