5834f6ae3522131494c225a93c30173430be80b5c144519b265395c54f35172b

Analysis

max time kernel
1507s
max time network
1494s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-08-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setuploopbe1.exe
Size

992KB
MD5

143a3ec92e603a8eb863bef2d6f4da12
SHA1

fc0a87961f1fa5d645ea63689b0e23b491092891
SHA256

0958b39c23e02f86ba63f520cfc333842e3f7c31e197416c12f2718756ecb9be
SHA512

49ce58b19b86f9d2062feeed62f15c87214a5324977ab94c3421add26f79d48a29e0d590266c25c8acf01bbcf369af6bc27b1e749e0761726210724d695a2116
SSDEEP

24576:H1FFxG1QXI0iWkKZnj5v747E2As7mb2uC4OS:lxGW4SvcoPgIC4L

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2156	setuploopbe1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setuploopbe1.exe

C:\Users\Admin\AppData\Local\Temp\setuploopbe1.exe
"C:\Users\Admin\AppData\Local\Temp\setuploopbe1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nskAC30.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskAC30.tmp\ioSpecial.ini

Filesize
724B

MD5
1b27945fcd5b3ad6e0e196f250babad0

SHA1
b914955b3809d5c1e0a05942b81e700dc1800bdc

SHA256
f2928f8ac715d34c3ab02784182b04d56fb6d692707b51a2d1ced635c8775ee0

SHA512
4da00ef985586455c82524a4d4b8de8b826425c49b0780ca739e5ecccac69f2dea9d08befbdb0b95db63e0c3fe087426d8ee4210745c0650173c8bc250badc79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskAC30.tmp\ioSpecial.ini

Filesize
763B

MD5
412f9a1c0bb2324f34f949971d765a98

SHA1
29561c7c2339789f6f9843ffcd3ad5b89a6b52f2

SHA256
437663ffccd8304613bd28402790373c08d2bac77b40002a1714ac36d830abfa

SHA512
51ea092fac8f772ca546511cad9722ab9d55801f51fcf1a5158327c906848d6fbb354143746cfddb1d61929ddfa8fbaf58093219ec50a399c86e115eb016f77b

Download Submit