Overview
overview
10Static
static
39eb87c0b29...24.exe
windows7-x64
109eb87c0b29...24.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Areas/page111.ps1
windows7-x64
3Areas/page111.ps1
windows10-2004-x64
3NACAH.exe
windows7-x64
1NACAH.exe
windows10-2004-x64
3Nacah_Manu...EN.pdf
windows7-x64
3Nacah_Manu...EN.pdf
windows10-2004-x64
3WAVMIX32.dll
windows7-x64
3WAVMIX32.dll
windows10-2004-x64
3a.dll
windows7-x64
10a.dll
windows10-2004-x64
10setupwin2kXP.bat
windows7-x64
5setupwin2kXP.bat
windows10-2004-x64
5setupwin9x.bat
windows7-x64
4setupwin9x.bat
windows10-2004-x64
4Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 02:40
Behavioral task
behavioral1
Sample
9eb87c0b29794234739b1fb08248b355eff2d7f73896186052c14894a49ab424.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9eb87c0b29794234739b1fb08248b355eff2d7f73896186052c14894a49ab424.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Areas/page111.ps1
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Areas/page111.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
NACAH.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
NACAH.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Nacah_Manual_Win_EN.pdf
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Nacah_Manual_Win_EN.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
WAVMIX32.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
WAVMIX32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
a.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
a.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
setupwin2kXP.bat
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
setupwin2kXP.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
setupwin9x.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
setupwin9x.bat
Resource
win10v2004-20241007-en
General
-
Target
Areas/page111.ps1
-
Size
26KB
-
MD5
3388d77313ce6cf7f4f97976fc48cad4
-
SHA1
ac19bd0d0e3c5fe75d36d088d009d6ec5b70a138
-
SHA256
2e5e14db5ac2d4179248d8fcbdaa9cd9739886227d5fabd5034b7e7a01d2705e
-
SHA512
aa654a60a7ae7975bb603c4a8c25af4d3077bfd84d9708cce34ba114fde19baa88152bee577241ad8fb56f2c9d15ec9d9ad2c6d678ddca105f0994b5e9457b5f
-
SSDEEP
384:9Tmg1bxecCn0uybVOKdEjDO/HPnhDX+dy8qoa1rKDsOWZBH+r1Rlo/YqqYEGLUBI:9XrjHOKBnhDXEvFaBrrv+r73qZxLUBI
Malware Config
Signatures
-
pid Process 2624 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2624 powershell.exe