Resubmissions
05-05-2021 16:30
210505-lda1w1hczj 105-05-2021 15:22
210505-prcssfb9m6 101-05-2021 12:52
210501-l7d8w6sgc6 1Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01-05-2021 12:52
Static task
static1
Behavioral task
behavioral1
Sample
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
Resource
win10v20210408
General
-
Target
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
-
Size
19KB
-
MD5
5aac519e51e8d443bd6d50d8f4221ea0
-
SHA1
2649e34827acbdd93913b39ab35011fab2830233
-
SHA256
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42
-
SHA512
9582fc5a96d696652064a831f7fe0296c36210fb34ca946182cddbbe4b95ea37ad18a8870283f7289e527ecaba04a736a93c1e0afd113b3ceb974a3192ce4bd2
Malware Config
Signatures
-
Modifies registry class 1 IoCs
Processes:
OpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
OpenWith.exepid process 3692 OpenWith.exe 3692 OpenWith.exe 3692 OpenWith.exe 3692 OpenWith.exe 3692 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-114-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/632-116-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/632-117-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/632-118-0x0000000004D30000-0x000000000522E000-memory.dmpFilesize
5.0MB
-
memory/632-119-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/632-120-0x0000000004D30000-0x000000000522E000-memory.dmpFilesize
5.0MB