64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077

Analysis

max time kernel
86s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 13:43

Target

sidify-music-converter-free.exe
Size

165.7MB
MD5

afad444bb905e28e4c077cbf4be114bf
SHA1

e6d7cac504a389c3cd443f51353b2fff5218923e
SHA256

64690e666518ea5fa250cb3f58b626537af21b4ccc4d58a1eebdf0bf11f10077
SHA512

63eb9209a4683109c528456a95d8aba088767b7ed2e83666f5ab7703bce5f72879a411582f873bf567d5a6ad4ff8d3ead31f90bcd72ceb72a1093b87ed6c229c
SSDEEP

3145728:gadvRU1GIiRKYDXHh1g9vYtvDhQjNf066pO3FB9viXBs1p6xFFZLr01gAgF5Wci:gadvRIFubLHng54Lh2B0G7vyB6GF2uAv

Score

4^/10

Loads dropped DLL 3 IoCs

Processes:

sidify-music-converter-free.exe

pid	Process
2864	sidify-music-converter-free.exe
2864	sidify-music-converter-free.exe
2864	sidify-music-converter-free.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

sidify-music-converter-free.exe

pid	Process
2864	sidify-music-converter-free.exe
2864	sidify-music-converter-free.exe
2864	sidify-music-converter-free.exe
2864	sidify-music-converter-free.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nslD4B7.tmp\AnvsoftNsisPlugin.dll

Filesize
1.1MB

MD5
0929466d9848e3f63841d7f005a97080

SHA1
8a20db1102d2051c01a8ccc40d5717736dc37ae0

SHA256
c0ac3ddeaa391c043bf53d78e8616a237ca5123ea828387a5319a18c654a468c

SHA512
666b6884135392d33238f18c163274865c80d0bd28aeb03fa242561a5d4d28a717bd9ab8d9b85ac12075d47f33d3804323e93e3608f6f7c34a19c5a627d6b0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD4B7.tmp\System.dll

Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD4B7.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit