a58eb6df9eab33d850e6c28363bd1fe57fb8160ef1da3f5702b1c150d4bf701b

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 995KB
Sample241004-x7rbdssapp
SHA256 c64b3021b4190b508c350ba2538207d418945d0014a5467d1aec1ca76b3e9e91
MD5 cdf558ffaa5c202a5084cc198300d975
SHA1 2caa8287fa7a817c2529c185fbde29c8da6728da
SHA512 4643ec7cd89b98e16a8512f9c59301b27bfaf38037745c08d60858fe04e1bb7136b2dc54bbf846ab54c8b6fe3f10c5e7251f02fe934025811d7277685aeed469
SSDEEP 12288:ZHXfdUgIC+kZhpKiCQo4wqLWgg85A09ijarEnxJy+3kZuHGMzvPjkiW1:Z3mgIC+QvtlzRtTsjaQnxoHwmMb7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2692	setup.exe
2692	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsoF1CF.tmp\ioSpecial.ini
Size 720B
SHA256 502d3aaa0a4c2abca08ccc7b413b4cc8b833075bc1747a09f2e42a2129f192b3
MD5 fc879be670fac960315759a24a91db84
SHA1 7b5cacfa0fe70f0cf6500065efaf169af5ec6573
SHA512 8d515ed72cc30a162a0341fbf753d2600f60fbf4ec98e6a24df5ecc00e626b818e556825a33c27a23dca793308f7839d7e6f10c40ac1badd3a4d2afd93e8a41a
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nsoF1CF.tmp\InstallOptions.dll
Size 12KB
SHA256 191fab998e58b66a2416873b06062166b547eb3ba06b1326a4a785a566aaf76d
MD5 f407939127208a009b9a825cb77ed3c7
SHA1 051d7fccf3fb544acaa8ab6be590bb4bc79cef82
SHA512 d45d08823ac7667f071b21d238b7fda43115db3195a442cb17d880d147e8a930374403c970afc31f676f01a83fb9c63e3be047de7e16718a08a1fdbe4b690901
SSDEEP 192:hzixixDOHhG9db9rd+oSVPECMlh3I8tqDyn/7hwbbHF1QuCb:hOx0DOHqrdwTY6+n/72bbMum
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenu.dll

Path \Users\Admin\AppData\Local\Temp\nsoF1CF.tmp\StartMenu.dll
Size 6KB
SHA256 adf51f6f088f3bed7d88350cc77812d9c19a575ec0d477bbe6d744dd9cea06cc
MD5 740bd475a180892e4cb98acc14cd360b
SHA1 f71ea3c855d3a0f96c3dd1a2776d21fa273833c6
SHA512 b8a51cd72acfdc3e589f5baa941537d4e51cfb6f73572f228651208aa89bcfd737beb7a8675e235fd0327a19516dbcd393fb8e6c5faee5a879cca28f46da840b
SSDEEP 96:mLJdRZk8OkmE+WHw0FMXF6CWhFxKpKsWQhEfP0:mLjPk8OT30FFAzCP0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads