302ef42805dfc9c42acbe0b4ae83526ebcfe7e86b9858d03e80a1eabfa416999

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe
Size

6.6MB
MD5

73a5737c32879d598ce724d7d56852dd
SHA1

c7a89c92011b53aeac4510233998937e4431c5e2
SHA256

12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495
SHA512

ad09b65fbb32ea02d499b43645a63b9d25138710770da47cce1803289b417954a5fc4973b7812c10356e8f9f4cc2e627bfe81884f4400833511f211186af35b4
SSDEEP

196608:LzU3OpDzbXdJcy3O8pyfITXmJAUDG17CC:3U3Szd+cO87TBuG17CC

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DrawPadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe"	nchsetup.exe

Executes dropped EXE 1 IoCs

pid	Process
1964	nchsetup.exe

Loads dropped DLL 4 IoCs

pid	Process
1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe
1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe
1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe
1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	nchsetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30
PID 1996 wrote to memory of 1964	1996	12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe	30

C:\Users\Admin\AppData\Local\Temp\12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe
"C:\Users\Admin\AppData\Local\Temp\12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\12541970a0c7bca13fcb517b7fbceee200c475dc15d4d2d803c1491da77ec495.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
6.7MB

MD5
c0cf626ed705d2fab14eab7c809876bc

SHA1
896cf98a37f299af42a8b80395aa675f917e7048

SHA256
bf2305daf167d3b30b8485269e8f1c47682286a79ebe69a609670223d73a96b9

SHA512
d8cadfb162205d70f1c9a1fdb2370ee7e0bc3ab20d9a8d592d7f9464d3d9e7e6cb6f447b1c806b2857625927ca166cd3b3465a0dd41cb640a37c25e3ed2c7a60

Download Submit
memory/1964-22-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1964-23-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads