d836b626e70c6e8dbe4a2f0d2e0d410cf84b343473743cc27e174220dfb9d633

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

imgdksetup.exe
Size

613KB
MD5

d5d66d8ab6139f16f7c99081d806c308
SHA1

cd6d8e44c71a28540adda464900e3c17211301fb
SHA256

b6ca358c614c15cbde926a128efd59b9af3b05dcf40330d5acf68d06de7c8ffa
SHA512

9d862cdb377962a05ff988fe2538e4b140b11a65d4cca2dc456c3775698e77e008a6af81505652a83dfda940dd25acdd0d87a9bb49d931a24c49d010a0e7532c
SSDEEP

12288:cf5szE8jO36RhiQ70UlAZhn5M/8INqubvQtk28eRmUZsta0K:AszE8jPigWOtvQtk28eRm3tHK

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2992	imgdksetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	imgdksetup.exe

C:\Users\Admin\AppData\Local\Temp\imgdksetup.exe
"C:\Users\Admin\AppData\Local\Temp\imgdksetup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstC572.tmp\ioSpecial.ini

Filesize
613B

MD5
ac1287e1a086f0d44c65afa0a4b60313

SHA1
154b01a8c1822d63f0df09fba963491ccd4bd29b

SHA256
685c114fb0beb9fd5e94d0de45a344684cebbadeeea65d4aaab1b0190a188be2

SHA512
c9e75233e088c08ee46797302836aeae263f0e2a6c849c523d6d9be5d160a7b54580b5e2ef7853b176af8ddad12fd2a44c5aaa9669be1838faeb3d6d71db036b

Download Submit
\Users\Admin\AppData\Local\Temp\nstC572.tmp\InstallOptions.dll

Filesize
14KB

MD5
107737e3282fefd85684f2fa3df6d1c3

SHA1
3befbcae116a644ae28cebdc1d7dfe6be5c8ca5f

SHA256
21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0

SHA512
439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4

Download Submit