Analysis

  • max time kernel
    1794s
  • max time network
    1768s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 02:21

General

  • Target

    42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe

  • Size

    107KB

  • MD5

    7d51abf861c7d1de546b7fddc1800e01

  • SHA1

    d6bbf02ec922ba035d863ec813221f15ab4c2bfb

  • SHA256

    42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7

  • SHA512

    068893628cc9e46117866e2526bb57cea6c13f898e930c3366fcfab457807673270e3f9b4b8740b99c15f521adc775970d5d2a505f2270980805dfc705ddc7e6

  • SSDEEP

    3072:nAsj8MBX8s0oXJ4455EGag707Igl8BTs6bdr:nAsBZyyhaS07Igl8BTsYr

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
    "C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
      "C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsu7E08.tmp\System.dll

    Filesize

    11KB

    MD5

    883eff06ac96966270731e4e22817e11

    SHA1

    523c87c98236cbc04430e87ec19b977595092ac8

    SHA256

    44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

    SHA512

    60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

  • \Users\Admin\AppData\Roaming\NsResize.dll

    Filesize

    61KB

    MD5

    543a9f0c51f22aac338722a03fd57bdd

    SHA1

    cb0ac20b3c6b14c893608cdde4f70354fda95b8e

    SHA256

    1cbd41a53f7d6fec146de933dad6443c274c072aac0ba289cc4c58405eeb2c26

    SHA512

    f83666984e220e83db6a67488ceba671aa4310e1d0f74510b1dc0b0fc44918ab5fb7fc927d11f27a03a3ba067c33d47b5b452486f4de28f65050ad5af01a4329

  • memory/2532-9-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2532-24-0x0000000000520000-0x0000000000536000-memory.dmp

    Filesize

    88KB

  • memory/2692-13-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-23-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-11-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2692-19-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-17-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-15-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-27-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-36-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2692-39-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB