2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe
Size

3.6MB
MD5

7db8604c051e9c8fa15beff8a0f9227d
SHA1

d0af81a71921d02efdbb1241e5998059a9b1bc5a
SHA256

2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5
SHA512

bb0c5e640f7c22ad991089decec0b606a2985285cf1a055538cafadd6dcd16d87b22cbf42630022926a79e704e59f78e29aeabe94ccecf382e5916fc22eb5ccc
SSDEEP

98304:vHBzFW8nyA5gpxTDYzGIms9AdfrvDShPL88L7eUOmr:vu8nyA50U8dfrvMP/7eUF

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1556	2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe
1556	2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe
1556	2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe

C:\Users\Admin\AppData\Local\Temp\2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe
"C:\Users\Admin\AppData\Local\Temp\2d823521cedf5a958f682bfe30dc6b066f813f6f53d5311d814fce946f0f58a5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy827F.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy827F.tmp\UserInfo.dll

Filesize
4KB

MD5
2f69afa9d17a5245ec9b5bb03d56f63c

SHA1
e0a133222136b3d4783e965513a690c23826aec9

SHA256
e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0

SHA512
bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy827F.tmp\ioSpecial.ini

Filesize
1KB

MD5
b4a33785d3dd4ed4cf69d004f3d4368d

SHA1
4e8737d23d966e7e08cb1a1037ade54aacfade04

SHA256
2c6a199d9110288ff5ba924d1bf00a40697f3c30bd33bd507d962ad92b7ffa9b

SHA512
42713dc233605a1c126034f10ec848b92c6d892726c7fc43dd0dcba4ae3d1ee8ccaaa0bffec4eeaa51d5faad9c3073cb8e1570a2985c5b924dcd8848fc2b4c79

Download Submit