Analysis

  • max time kernel
    152s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 19:08

General

  • Target

    TotalAV_Setup.exe

  • Size

    54.8MB

  • MD5

    7e1760c63553d56fd73d0fc2dcbf4b5a

  • SHA1

    3bfba02d7ecd632c34de3803faa73315be4edb98

  • SHA256

    b9a83fd92044028d1dd0264b972c95c2cb7564e8bbf480b245c8bf28a1dcb51e

  • SHA512

    5f732813fc40726f8762297ad0856232dd94c30695949915a1b2bc5303429765acec772c21408e9b88fc469a16ba721f58e1a8827ef797d002b666d756aeb00b

  • SSDEEP

    786432:lcAokzH8aNMYff0v2oOPWCf4/CK8aAsy5fkMOgs34S7F2MOoQJ+LAgsFGUET9Xhc:l7HHff0C74/C5a21VsKMOxa72GUWxA

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\TotalAV_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TotalAV_Setup.exe"
    1⤵
    • Loads dropped DLL
    PID:3488
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsq2CAB.tmp\System.dll

      Filesize

      11KB

      MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

      SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

      SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

      SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    • C:\Users\Admin\AppData\Local\Temp\nsq2CAB.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      1c8b2b40c642e8b5a5b3ff102796fb37

      SHA1

      3245f55afac50f775eb53fd6d14abb7fe523393d

      SHA256

      8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

      SHA512

      4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57