169605839aebe681cc8f32304083932a0a710dad4d24c900a9dc17d92f6efd29

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 01:15

Target

FiddlerSetup.exe
Size

6.3MB
MD5

77a80b10028f9c800c5cbb5a80fde929
SHA1

7e8a8ce83bba6bec7b62cca06ae7680ef5c5ddec
SHA256

207e1a39c74a03ae535ad04fe74bc435baa777ecefaec95abe78664cd2b34690
SHA512

883600cb4d5114cef47dba6d7fde929c02f0f4d2baafa9dbb746fccfee92ebb6bfb02602e64dfb2c93b773abfdf8b49ac780b0c02414107761dd66e6999480bc
SSDEEP

98304:mIouszMd5OYRxqFu5rMnb8ELGUHjvYEarhIPAT99taafHOwRcxzv77Nd6fKnCKbX:FqzMSx3oohYTXt5WwREv77cKCKkBbYOY

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

FiddlerSetup.exe

pid process

2344 FiddlerSetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2344	FiddlerSetup.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nst446C.tmp\FiddlerSetup.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nst446C.tmp\FiddlerSetup.exe	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

FiddlerSetup.exe

description	pid	process	target process
PID 2140 wrote to memory of 2344	2140	FiddlerSetup.exe	FiddlerSetup.exe
PID 2140 wrote to memory of 2344	2140	FiddlerSetup.exe	FiddlerSetup.exe
PID 2140 wrote to memory of 2344	2140	FiddlerSetup.exe	FiddlerSetup.exe

C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Local\Temp\nst446C.tmp\FiddlerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\nst446C.tmp\FiddlerSetup.exe" /D=
2⤵
- Executes dropped EXE
PID:2344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nst446C.tmp\FiddlerSetup.exe
Filesize
3.1MB

MD5
7e3090e237b9f252efc88d097f71ed47

SHA1
8a1cae86f421c4c74f7f543609826cfc472e5fa8

SHA256
91547aa10f5b4d1be95c7bfa289499ded2b65d1070ec6fce0208e61771df5318

SHA512
378d29ca00b73ff5b729d6bc39e63b61f833f7baad9d806db77ee7acab993b3b567f7e533aae2178bf8a9391bc8d205aadd72d75a29a71c0f2827196ff040afa

Download Submit