503fedaaad4914ad8c22fd4a2311711ee049c5d5c8134d0961d4ba23a29d7447

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 12:49

Target

replacesetup.exe
Size

6.9MB
MD5

af534de9b548a234c27f213e5b984dc9
SHA1

a4a07ade41a6c1ccab7924147aaf19e6700f7d08
SHA256

3d8e71720ee2266b093c3f7e177953fe69f6afe4335048a0b2ec0cd92c148e78
SHA512

72692490f5e938daa4787421effd883a03eaae7281dc31a3092c99c6df01f1524ac169d5e878b213681436954177dddd34b6f99ab66b68ffbefa2986c917d7a6
SSDEEP

196608:Sv7YHNv963eFwEIDPOau9CfciTccGsCizFum+ZRx:W7gUZHOauWckccZVzP+ZRx

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

replacesetup.exe

pid process

2204 replacesetup.exe
2204 replacesetup.exe
2204 replacesetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\replacesetup.exe
"C:\Users\Admin\AppData\Local\Temp\replacesetup.exe"
1⤵
- Loads dropped DLL
PID:2204

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\gentee00\gentee.dll
Filesize
100KB

MD5
30439e079a3d603c461d2c2f4f8cb064

SHA1
aaf470f6bd8deadedbc31adf17035041176c6134

SHA256
d6d0535175fb2302e5b5a498119823c37f6bddff4ab24f551aa7e038c343077a

SHA512
607a81be02bde679aff45770e2fd5c2471d64439fdb23c3e494aed98970131e5d677e1eba3b7b36fca5b8d5b99580856bb8cf1806139c9f73693afb512126b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\guig.dll
Filesize
20KB

MD5
90bfd564e933b1cc869f93ac7e6b44a4

SHA1
5d076148cc596cca80f6d4accfbfc75ddeba9c3e

SHA256
e4fde74ae74ee7ea07f88049fb480c9b11fe94c69baa7c4dddc31bad776a1a25

SHA512
4c775a89d3bb64f0b6b47ba79860780474dca67190c6f873133873fad7353765ed3f374bd5473a66d0cb14ad4153d88e1824d95ad75b80cf76b3c9a31869c1e8

Download Submit