85ab9958e4dc3181a12de70b84ee73789083a374b687434edc9c8bc6cb4f8c2c

Analysis

Target

Twitch Monster/linux-chromium/swiftshader/libGLESv2.so
Size

2.7MB
MD5

3d799b971d0c0d3003b17bdb240c952b
SHA1

bb776a53e03c847d8b842e62fe2cd3fb982563e7
SHA256

82fdcccdfbf7d22fd267f9f2508b493bc105cdffabe948d20f479aacb2e8bfb3
SHA512

4d2bee45b6d0a588edca494d2f9169801a3724e58a2562f860c819d59550f41b704461bbfd7bab3029099e73a02c66f858e04f42dac2ad93c9f1f05722ec65b4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2712 OpenWith.exe

pid	process
2712	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Twitch Monster\linux-chromium\swiftshader\libGLESv2.so"
1⤵
- Modifies registry class
PID:3196

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact