e198a1cf6988b3e8bffa5dec0b28c891c5ef4116c71fbc94d9a68ed9e9b444eb

Resubmissions

23-01-2023 13:41

230123-qzjg9add79 10

27-12-2022 17:22

221227-vxl8ksfd97 10

27-12-2022 17:10

221227-vprhbsae8t 10

Analysis

max time kernel
230s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zsys-master/yaru_widgets.dart-main/example/linux/.gitignore
Size

18B
MD5

512dc82cc7c62f40b1e946232def5a13
SHA1

cf4f48a05192c4b17f4e92c45fdcf649e1af2c46
SHA256

5ded4f1a9d10d34bf6ee5beb0711d88ee2ef07b0f07ace9ed77935a246e8eb82
SHA512

cc0a0c32a23f97c03d5c7148470c28f706e49cdde546295f1cf40df10c549619c0a88ad5de92e83046f5c34ce032c10ed2d730f903a08a4aa213f15a8fefa759

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

OpenWith.exe

pid process

492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe
492 OpenWith.exe

pid	process
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

OpenWith.exe

description	pid	process	target process
PID 492 wrote to memory of 4772	492	OpenWith.exe	NOTEPAD.EXE
PID 492 wrote to memory of 4772	492	OpenWith.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zsys-master\yaru_widgets.dart-main\example\linux\.gitignore
1⤵
- Modifies registry class
PID:5060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\zsys-master\yaru_widgets.dart-main\example\linux\.gitignore
2⤵
PID:4772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-132-0x0000000000000000-mapping.dmp

Download