Analysis

  • max time kernel
    100s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2024 21:59

General

  • Target

    6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe

  • Size

    3.0MB

  • MD5

    5be84affded6a459de10d6490bc42f25

  • SHA1

    c901557593506294588fe36e85fcb0de94b71778

  • SHA256

    6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9

  • SHA512

    92b7b930aed7b6df7d71d76e404be566f0fccdf507f048cccebfc9d78a14e8086fc05900d88438bcb7527aec96651cbef1c8cec7cccfee71dd1cdbbb741d9ff1

  • SSDEEP

    49152:IARVS4nHwHHzaG0fuEqhfzJ3LKjcniRSVSHo8Vnt9/URlWbEc+YV48GbjMQHaX82:IYPnQHTa3uJ3LKYvVSHoA9/WlWbEyC8X

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe
    "C:\Users\Admin\AppData\Local\Temp\6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsoB5BA.tmp\Processes.dll

    Filesize

    56KB

    MD5

    cc0bd4f5a79107633084471dbd4af796

    SHA1

    09dfcf182b1493161dec8044a5234c35ee24c43a

    SHA256

    3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

    SHA512

    67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

  • C:\Users\Admin\AppData\Local\Temp\nsoB5BA.tmp\ioSpecial.ini

    Filesize

    710B

    MD5

    8b8b8ed5106149fded77826f0c7378c6

    SHA1

    3075d2e91008445e30d1e8f0c0f9421c35321806

    SHA256

    9cdf6ffe09c81a38be71b7254ebc8c8beb43cc85e43c66846610abbae63931ad

    SHA512

    0d86644d3dc9aaf94958fe813b9b76bfcb8cb4a91f0dc4eb9d266c17cf26009a9950d05182795e9f724755d55b7b06524ea793d1f59410ecd7dec003e0a42e3e

  • \Users\Admin\AppData\Local\Temp\nsoB5BA.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf