Analysis
-
max time kernel
87s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
18/12/2022, 18:06
General
-
Target
Fluent-for-Steam-0.4.4.2fix/resource/RemoteClientConnectionNotification.res
-
Size
270B
-
MD5
a78deb9b7d79d6938b3187be348112a5
-
SHA1
15efa21fe87e9f5b486863c1b45b0157f2e141cb
-
SHA256
9d41116244ba2769bf21e8beb483152ba65fa4fa7e7ce57f1dac549611bea72a
-
SHA512
40e9544fde6d884a1b3296585103e093df5f773a22ca17b29aeb02aac9a7c8b95cad0a23767dbeb61260fd3998e8342c2a3e6e4ebd6fdd1a717ee7d97936aeef
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Fluent-for-Steam-0.4.4.2fix\resource\RemoteClientConnectionNotification.res1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx