48a491826c731d592bce74e335a379923942b2fb12cdb09ddf342cb31acd4d11

Resubmissions

24-11-2022 20:51

221124-znevcshd32 3

Analysis

max time kernel
230s
max time network
249s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.rar
Size

4.9MB
MD5

75b2e6ffb6b87900684158c5c412943a
SHA1

7ebd4f8a61f8a6afd4ac90c077bcbb6434182ea2
SHA256

b7779d91cee6fc6df107e867ac1fee5d489cf55f321aace62728d33a8cdd6db1
SHA512

1478b655a4d045677aeb8b607bd239b43c8d4dd976c217105fbd57da7999f31a05fc7afe55aa5a0eaff5baab1d76fe8ab0498876190661464c2c9d280b37490f
SSDEEP

98304:wquRcp6zh+qkX0FCYqHMaxWKiqmDw4uxa0FsTcxI2hpOFD8EmroouQgP9nqKduJC:wCpkQPs+WKvM/SSQpOFD8EmrokgP53kC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3676 OpenWith.exe

pid	process
3676	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\setup.rar
1⤵
- Modifies registry class
PID:3136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads