d69ffc834e107c749462f1c39fbf1aeb1d6ffd344c3e3788e1b30268c142d2a1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xp-AntiSpy_setup-simplified-chinese.exe
Size

301KB
MD5

c4060d4966fb91389ee0966334c3161a
SHA1

3286fda7158a3a2e9e0251f0be25436919c945eb
SHA256

c698e08514125abe6ae27f2a1db74a1e78dddb6983f0bd3fea19e6d5f1b1d8f7
SHA512

14f13537b1a66c88d3f2ba02c8e16e60f8cc36a17a43d7c5053e472d9027c2dd513b194f8ee442135bf332a003f3090aca4b4e13bedee856c76ab963533def72
SSDEEP

6144:Tr/3K7EY/bgErxDCT2ekezWWpqCp1YiUiJcruG:38E3yxDy2e2WJp12iJcruG

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2208	xp-AntiSpy_setup-simplified-chinese.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xp-AntiSpy_setup-simplified-chinese.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	xp-AntiSpy_setup-simplified-chinese.exe

C:\Users\Admin\AppData\Local\Temp\xp-AntiSpy_setup-simplified-chinese.exe
"C:\Users\Admin\AppData\Local\Temp\xp-AntiSpy_setup-simplified-chinese.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyFDEF.tmp\ioSpecial.ini

Filesize
609B

MD5
6f91628427c6f54c1b22ab0111c3aa5f

SHA1
eefdaec385b6e68c3fc3668773a48f3b533f7edd

SHA256
4556034e193ff0eda877260f62ccb2d1c7b2b31bac20d0b5743ef275c1b09f96

SHA512
952b911cd24b80d1dbe1cfce43a60b508213d765bcfc21d4f82714fe6debb034b3a0136e2ed1b046e504bb34bb3ab729ee698790177b95761756a710ba6c3b5c

Download Submit
\Users\Admin\AppData\Local\Temp\nsyFDEF.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit