48a491826c731d592bce74e335a379923942b2fb12cdb09ddf342cb31acd4d11

Resubmissions

24-11-2022 20:51

221124-znevcshd32 3

Analysis

max time kernel
655s
max time network
541s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file_sharing_and_storage_made_simple.rar
Size

4.9MB
MD5

6df818c58b0f613057f1c951ed04f4f3
SHA1

0017ae6b8f3586837b909180d87fcb5db450ab7a
SHA256

48a491826c731d592bce74e335a379923942b2fb12cdb09ddf342cb31acd4d11
SHA512

c36dd8874d41a8cfb15e9e27f80d28415b4a2154a6d640e718bf3652dfaa3196fbf45fbb958abfefce6435414e33b6545ec487fd0862ee7206621d963139a148
SSDEEP

98304:NquRcp6zh+qkX0FCYqHMaxWKiqmDw4uxa0FsTcxI2hpOFD8EmroouQgP9nqKduJB:NCpkQPs+WKvM/SSQpOFD8EmrokgP53kB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4680 OpenWith.exe

pid	process
4680	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\file_sharing_and_storage_made_simple.rar
1⤵
- Modifies registry class
PID:3652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads