a4e10fe06bb5202f8b07f3264adf23bd3d3825e214fef6b096adbe5d6a530e91

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPLATES/Setup.exe
Size

1.1MB
MD5

357a8dd0433cde3759f13b42f493c4e0
SHA1

2ba4a971e1d398589233e770030581a9767d4240
SHA256

2b4aa368f9b1363aa19b9de02f1b41fabde07d2359014eb456746cd7d66aba2c
SHA512

ce0432ce668dc60841832b0c14babd4e77a055709d9e0d027a51c2c6b500d99348f71d9aea2f1846781623289845a6690c037b8a1a40da97402f34651ba86488
SSDEEP

24576:FN605Kioe+2CrVFJwQmel0xeSadHsrRbnJ7ZGNTgDVwy4uY11jKRJ8f:fVXQmeD5dHMjJ7MgDVN8KRJw

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2712	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	Setup.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPLATES\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPLATES\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5FCD.tmp\ioSpecial.ini

Filesize
566B

MD5
edb105daadbc3bbd5f6029f2992041c1

SHA1
1dfdf91bbee8c179a64826b3311852b56c144f54

SHA256
47639bb595113b6f5b3754c85073c573df6b446f47cba306de1ba923af732c1e

SHA512
b109882a2b120c883b24d59638ec183602fd15cad4258a81209d1c12442c66bed3abd8746ae93d4b6b3e05927d6168edbed38e6c3bd77458e03d182d3912116b

Download Submit
\Users\Admin\AppData\Local\Temp\nso5FCD.tmp\InstallOptions.dll

Filesize
15KB

MD5
9a886711c559308c39c01c20e9d9a1e3

SHA1
0f27cf1cf6e4960e140651b68d72ed4b92c58e9e

SHA256
98be8860d38ad9cf31b55a1a04594de59eabad67510ba2a33ed20a80863ddfa4

SHA512
4dabdd9ea7a8330a367589a3975a9dc7286b82c66efc7db118b4d7a2db08a467851c6d3dc991668e13c4dd5473aa974e9696a2226039db94df8b198da54354a3

Download Submit