Analysis

  • max time kernel
    140s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-07-2024 21:59

General

  • Target

    $TEMPLATES/Setup.exe

  • Size

    1.1MB

  • MD5

    357a8dd0433cde3759f13b42f493c4e0

  • SHA1

    2ba4a971e1d398589233e770030581a9767d4240

  • SHA256

    2b4aa368f9b1363aa19b9de02f1b41fabde07d2359014eb456746cd7d66aba2c

  • SHA512

    ce0432ce668dc60841832b0c14babd4e77a055709d9e0d027a51c2c6b500d99348f71d9aea2f1846781623289845a6690c037b8a1a40da97402f34651ba86488

  • SSDEEP

    24576:FN605Kioe+2CrVFJwQmel0xeSadHsrRbnJ7ZGNTgDVwy4uY11jKRJ8f:fVXQmeD5dHMjJ7MgDVN8KRJw

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMPLATES\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMPLATES\Setup.exe"
    1⤵
    • Loads dropped DLL
    PID:3192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nspDD90.tmp\InstallOptions.dll

    Filesize

    15KB

    MD5

    9a886711c559308c39c01c20e9d9a1e3

    SHA1

    0f27cf1cf6e4960e140651b68d72ed4b92c58e9e

    SHA256

    98be8860d38ad9cf31b55a1a04594de59eabad67510ba2a33ed20a80863ddfa4

    SHA512

    4dabdd9ea7a8330a367589a3975a9dc7286b82c66efc7db118b4d7a2db08a467851c6d3dc991668e13c4dd5473aa974e9696a2226039db94df8b198da54354a3

  • C:\Users\Admin\AppData\Local\Temp\nspDD90.tmp\ioSpecial.ini

    Filesize

    605B

    MD5

    54e3e242f29ae8cb6ee0962d903b5220

    SHA1

    d3a2fc8db4788941fa2e1ba850dabb3ebd203572

    SHA256

    dbe37b052bca2a14c2186b385b5012a0e45a13e18ed6d647f9aa7b84e485313f

    SHA512

    f8190cda77713425594db7dadc35eab544d622b732aa6265865d2f6e3f7f8e8822c6d1a8d6bc318c657928cd870f685c07113db75c2773a9f82056f89f607db3

  • C:\Users\Admin\AppData\Local\Temp\nspDD90.tmp\ioSpecial.ini

    Filesize

    566B

    MD5

    4dc1f9ed5e44e307b4038e7293574c36

    SHA1

    be05320f02be3121975593dbd832c72d768e285c

    SHA256

    5ec4941cbfd27f16cfb066ab32f6c83738747cae0015c78bc1b5b8f4ad52c19c

    SHA512

    0034c9bf59f648c8db41665b6f21b18e665be1c1da6a56bccde9ac3c28cebbb1419e30f1b50630d9efb5fe8a15f1c7d4f9815acb3fc249c172702d2cff9fa35f