b10b48cf55b004e377f60df81fddb75bfeea712062f6a30da39713038f52045b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CommissioningTool64_1.6.11_Setup[1].exe
Size

19.4MB
MD5

66ce370d01d3e99e128bb02dc51c39ab
SHA1

2abce930f957a2c5ea31f52722bfa0cde46cd1ab
SHA256

c7aef3a2baffe891e6e72cb30365a474122f7659e3ca6e5adda089025e3e5579
SHA512

cd57f5ffe503baef80788715d1dcfd7f92a583fe5eb8a2d277f36ccc050583bdfaf46227c8e12fd44138337ec2a4729143bcdd058571331a8d9f032f04ab9714
SSDEEP

393216:h+Jn+OLO2dHo7gMxt8QHpMd5He3D5MBwZMd0b4oSQ7VSrAs1gEdUJ:hSLdI7RydM5MO+8dVWA8gEdUJ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2016	CommissioningTool64_1.6.11_Setup[1].exe
2016	CommissioningTool64_1.6.11_Setup[1].exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CommissioningTool64_1.6.11_Setup[1].exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2016	CommissioningTool64_1.6.11_Setup[1].exe

C:\Users\Admin\AppData\Local\Temp\CommissioningTool64_1.6.11_Setup[1].exe
"C:\Users\Admin\AppData\Local\Temp\CommissioningTool64_1.6.11_Setup[1].exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoC505.tmp\StartMenu.dll

Filesize
7KB

MD5
8fb72af40578e779e69049cccbfb473d

SHA1
3cd042d8ec9e2216558e96a2663b6e42d33aab56

SHA256
70a91d4b67b0017beb83e93724e799e2cde82cb2500d872266bf478878840d0c

SHA512
15453d4e7f894084a3dc385f9d17299920d09903d38b68af69da25a93028432a02c900372aabafd1998fe016e53572a81a55c04791aea5cd5291804002d9398e

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC505.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit