85ab9958e4dc3181a12de70b84ee73789083a374b687434edc9c8bc6cb4f8c2c

Analysis

Target

Twitch Monster/windows-chromium/90.0.4430.72/nacl_irt_x86_64.nexe
Size

3.7MB
MD5

9d901664701d62e75c7dfe9774595e3f
SHA1

b9116dd8207f60bba42e31a2fca776de0e1fb615
SHA256

4036db27f19e35dcc3deb09cfa265012f7fcf55067c245aaf5a5f7b9cbf77f3c
SHA512

ff3755df691dc73aed0519f172977f718666cf74edfdfd756b28d7eb7d9617dd18d55e0f27563b4851f91baefdd852fc3d59ced9c1edfdecd9531ff50dc8bf7a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3980 OpenWith.exe

pid	process
3980	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Twitch Monster\windows-chromium\90.0.4430.72\nacl_irt_x86_64.nexe"
1⤵
- Modifies registry class
PID:652

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact