Analysis

  • max time kernel
    111s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 01:09

General

  • Target

    52e2e14aad4d70872bcc1e124d1631f0N.exe

  • Size

    292KB

  • MD5

    52e2e14aad4d70872bcc1e124d1631f0

  • SHA1

    d1530d0241bcdeeb50c9f02d619882fa0bb7e41a

  • SHA256

    3af560d472c2148e91c502b48ab368ca615919236381e9cb390c91bbf631467b

  • SHA512

    e5394a10452f83643ede4444709bd82cf4b8bac6b284eeb169c8fefbf1eabab5c2e0f6af3e25fc1770a8b0844e3b256ee5cd16235767be072ab7909a050326e2

  • SSDEEP

    6144:wQ3IanM3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2j:CanM3D0Fw/tN8dkmLtpHHHrh7w

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\52e2e14aad4d70872bcc1e124d1631f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\52e2e14aad4d70872bcc1e124d1631f0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsz9770.tmp\System.dll

    Filesize

    10KB

    MD5

    7fbda5b7be6256996d4e59e5f6949918

    SHA1

    2d36c0e0bfbe450675c6ed044e715abaa85a252a

    SHA256

    9bb31f7f02231e3166bf52385d804c06da9740e9c6f0bda807b01052ae9fdcd4

    SHA512

    bc0d36aa6f50041bad05cf48d909ed5a387bff5b111f657591161a288c1be5c20b8c5d69e557b5ea395726d91601b9e6303da81555e053090cfcbf5d44be7f82

  • \Users\Admin\AppData\Local\Temp\nsz9770.tmp\inetc.dll

    Filesize

    20KB

    MD5

    e541458cfe66ef95ffbea40eaaa07289

    SHA1

    caec1233f841ee72004231a3027b13cdeb13274c

    SHA256

    3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

    SHA512

    0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c