03c35fcb1d10cf478c0b9896699937e6e262daa4f4a4353a7cc56b238fe86892

Analysis

max time kernel
20s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spsetup133.exe
Size

18.0MB
MD5

b86b975448d0b27727ac9c849318cbf2
SHA1

938c2d249c9bf7978b4828b9028b95b122ceefc3
SHA256

03c35fcb1d10cf478c0b9896699937e6e262daa4f4a4353a7cc56b238fe86892
SHA512

3c82955edde3f45fb45875223253351fe1938f58a307a4f7bc85a3971a5a92cddecd3d2bef31ccc60e233eb8a532ed4ab0f1708384cc4db91c02255e832a698d
SSDEEP

393216:vAfGg4AOfBzN0sIPREFXSIqGiAINgIF/x5kfSY1PfMhKokebZyjzJ:vAfGg4A+NN0xWoI2g+S6GPfMwovM

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1684	spsetup133.exe
1684	spsetup133.exe
1684	spsetup133.exe
1684	spsetup133.exe
1684	spsetup133.exe
1684	spsetup133.exe
1684	spsetup133.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spsetup133.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1684	spsetup133.exe
1684	spsetup133.exe

C:\Users\Admin\AppData\Local\Temp\spsetup133.exe
"C:\Users\Admin\AppData\Local\Temp\spsetup133.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\ui\res\PF_logo.png

Filesize
3KB

MD5
079cca30760cca3c01863b6b96e87848

SHA1
98c2ca01f248bc61817db7e5faea4a3d8310db50

SHA256
8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa

SHA512
3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\ui\res\SP_computer.png

Filesize
66KB

MD5
873b7c34ced38adaa2d01752099c09df

SHA1
e659d094f6e3fe6f71a3f1b047b75206bab168a0

SHA256
aced6376065f2c71b4b619823f735bbdcac967a5113cd4e6b978298a58c927c9

SHA512
a8d54d52bb5ec4502cd4bb829eef23c1b2edff9daeeca0f4fb7dbaa0cabdcac763a60aedc8393ba12a393a8263a5c06d3555d7b165cf9927dd9cc18d68b9e510

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\ui\res\Speccy_Logo_72px.png

Filesize
8KB

MD5
1787175d95eab213cf5a8bc25e252676

SHA1
1d4bd97b2bcaabd26f2ef7781b91233575e1ba0f

SHA256
65fa6baa9d140251d04069cf538f3262ebbb0e4e62d58d06cc58ad8b22085a83

SHA512
de1df226bb9bf84305aea43c237ea76937a9df0c56ecd9afeee1920c3f4d600fde0cc0c027ca397fb6067ffb1a7fe8c03496d82ed844bb4f47f32b2b30eda52f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\UserInfo.dll

Filesize
4KB

MD5
2f69afa9d17a5245ec9b5bb03d56f63c

SHA1
e0a133222136b3d4783e965513a690c23826aec9

SHA256
e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0

SHA512
bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926

Download Submit
\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
\Users\Admin\AppData\Local\Temp\nsjAD13.tmp\ui\pfUI.dll

Filesize
18.2MB

MD5
34be51649e001d1c92681154fbb14d1d

SHA1
36db635139493604dd85899a8b7855828f76d5d9

SHA256
61a03360af5cee8423fa7322ba660b54ca5034dbd97450e114c7a00d1cb740a2

SHA512
490f3851c17929b964ef5b8876cfa778c70e9145d20de92ab092e7ca71121c90fa8afec28ea0b2f91cdeebf3e67e3bd1c853f0ed532de2ad43c09daffc25c518

Download Submit
memory/1684-74-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1684-92-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download