3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5ca

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe
Size

114KB
MD5

f2c78bd63ee6e4fb154fd0dd96a90240
SHA1

a5c58ee3883aa288cec96dddd2c527eed2ee7e25
SHA256

3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5ca
SHA512

c3e3271720a69959726e79ffd9168c5d8b2cce3bfe35472cbfcd800f4cec17de7ce8389357e1b883797995140522e3cbf10104be4a6a437f98e338fd9d8d73f5
SSDEEP

3072:w5BuYAVrgUCPnd45zR6ZGnEQax4s9ThFEY9:w50gUCVER6E8PFd9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2744	3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe
2744	3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe
2744	3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe
2744	3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe

C:\Users\Admin\AppData\Local\Temp\3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe
"C:\Users\Admin\AppData\Local\Temp\3f9a1cb6c4e91909bd4b1412d8b4e09ea242f5974233f7932a37a4c47be3e5caN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst7B0A.tmp\splash.gif

Filesize
12KB

MD5
5ab4358068125130f2c7e6f5c9df3238

SHA1
c7ccde4343756cd0117f600826fac9e834d582cb

SHA256
97428f7cb859c13d0202e9305682473ef321890d124737f1d33e20349c7dbf47

SHA512
d482b89f06bdee9e39025bf225021cc90f7ff17cec720bf8c660f0157d0b9c67c071bac9a5e3a7c2cec8a2c70d4d08fa7d8267ac20e220d9f5493033856e7f79

Download Submit
\Users\Admin\AppData\Local\Temp\nst7B0A.tmp\NSISArray.dll

Filesize
20KB

MD5
5ae0c62802120e2fa971959795581daf

SHA1
e0c2d66ba75b41f8e22ff31c90986e572735429f

SHA256
a8c486730810c55c337c7d6863243fad25c212b4d11ceeceb420c4b2c131a605

SHA512
e09b14c1eef4c3962f18307df4abf4fbb62710dbf3cde80346069861b4db63e72b0441e0136921290725632f6c21b3916920e928f4df63b3f5c0e78b8e750101

Download Submit
\Users\Admin\AppData\Local\Temp\nst7B0A.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nst7B0A.tmp\inetc.dll

Filesize
27KB

MD5
bd30dd24c0084fd883949bdbdca225e2

SHA1
fddf52a9d22a6e614e202a0c55deb5752f4595eb

SHA256
e554d904b4903c74035772b4b20cb7cc508f7d27bfee79f424f29ad31d4caf59

SHA512
4d24c9160caaa8f3b0ca5ae13a8fc64d9c0fe722c274f63aa4c2d7379f8e4aa5bcdad45e49b62ad928d7bb759657e4a4915327fab0728ffd20dc838a4b6811e5

Download Submit
\Users\Admin\AppData\Local\Temp\nst7B0A.tmp\newadvsplash.dll

Filesize
8KB

MD5
55a723e125afbc9b3a41d46f41749068

SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

Download Submit