3fd157484c55d7b3871ed546865836985ec4995a38fae1b1719ceed6dfb5bb67

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jghdtv_setup.exe
Size

13.5MB
MD5

46eb15c6068f2cd47532d3573b832990
SHA1

73e241d24f6b7cb0c2492fdfc448287f45875670
SHA256

d999288dd836c32661e7fbce564f331b833caa2ae117449a671d168dd80212ad
SHA512

3ff5c11c18a65645032b97426de7d868c2f91b74247ab1f4f094833bf44d232ec61ba6071ca85e119ab7bc94e9e4f685f1e04573ed752ab9a0243364caef3217
SSDEEP

393216:kehlvQyCgSe/v85L1WTeXFeZNa8pGumCIwG2Wx:1hdQycsAMT5ZsmxTNGd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2184	jghdtv_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	jghdtv_setup.exe

C:\Users\Admin\AppData\Local\Temp\jghdtv_setup.exe
"C:\Users\Admin\AppData\Local\Temp\jghdtv_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso1D72.tmp\ioSpecial.ini

Filesize
626B

MD5
c701958c22233329773c5480e7194a1f

SHA1
f3a1c4d1f3d80953a2e44afa1e620eea137c4d41

SHA256
1fde288e7d2fab29e1f734ccf9d45a561a0591865bdc7c84c58050be43d49f6d

SHA512
5d388b7e9c87ff912357a973c957a7deba459393c2edc29ba604f83b00229ae664264414a53a3542dcbbcc6d2fc1b95fc7ba80cfa1ebc003999533ef052199e3

Download Submit
\Users\Admin\AppData\Local\Temp\nso1D72.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit