73da847648b175e03790c59c273b7a848efeb6b334802b1b46e9ef05bd5313d2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

STYLEXP2.7.exe
Size

21.4MB
MD5

dcd47ecab4c6bb5b98aa7db784d30cd1
SHA1

34e3ca63e9ef824cb74bb98b194ca09784511f9e
SHA256

eabed75897fb2700063d9d689eed25cc2fec2f018418dbae64cc8a7cbc5d1777
SHA512

b36575b46aef72b714d3d5fac3b001f4c30cf765596a7c059a2a21957b69854b6c9d52729555ab40192348fc40346bf7303318f4e80cf9c894de5472edd4d7d8
SSDEEP

393216:3YniCaEA0ALUQHLD4NVH/gxb8wi0QNOoxS1zWVWOlzWmEZ8tEgw:cJJALnrENVfgRMd9xiqVWO1kZGEt

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
992	STYLEXP2.7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
992	STYLEXP2.7.exe

C:\Users\Admin\AppData\Local\Temp\STYLEXP2.7.exe
"C:\Users\Admin\AppData\Local\Temp\STYLEXP2.7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi1B30.tmp\ioSpecial.ini

Filesize
645B

MD5
c0ba6906924403240d54dc1a3207daf1

SHA1
23fa02b69d047ddbd73583bd8640280b0d1b92b3

SHA256
4b219b4ed1fda70d79a97e287345490b57df11a26e982d033160a1f755970320

SHA512
c5c008ba88ea1e6c9fa6f295bb820b4b11cf2c511180b3322abf3343f1f4b6e98a0755318a5757bd7e1d46c1fb77b1dd136ab3504330ef9fdaa0253deca41a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1B30.tmp\ioSpecial.ini

Filesize
684B

MD5
5931d6e25447dde6eebfaac199cfe94b

SHA1
6119b75ca29c6655d6c9a9b52732c355f2dd0b6a

SHA256
7777e79e56927d3c24e62858d65598fee09ff3a537b4f9884581ae0956a00c6c

SHA512
f4111d58487187298f313522b4a35bab7f3d54963b95ea6515747c9bbb6720fe89a9a6d03f3b7d8bdb5acce0c98bfed3335b6a4fb967c26ffa5443f3f4d1164b

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1B30.tmp\InstallOptions.dll

Filesize
14KB

MD5
32aa6334fc543e70ef0f792bb9a0c45a

SHA1
54be1f5004f7e5afe7c9ba160495076ea2a4d60c

SHA256
610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2

SHA512
ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae

Download Submit