7ccbcd53a9b6957dd4c0653bf17d449084895b5098474253d8e5fd40f4c65e6b

Analysis

max time kernel
144s
max time network
150s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
30-12-2022 19:17

Target

UltimMC/libLauncher_nbt++.dll.a
Size

149KB
MD5

c9c008ca98cdaba11c0794813add3a2f
SHA1

76b3c48257db7e10cbef96686c78da6d263049cb
SHA256

47329fbab79945214198fc19d2e1e2a02b941212a357c947bacf6a6aa5524d5d
SHA512

6c8c1eb209b8c8dcee6367fc11a9b7ef00d3fe7ac9f76c9d7c2031e9fdefa9933a3b9757e2876e158b3a3a3d910198704ca15ca608e51137cedc21b9dc3c2796
SSDEEP

768:PPr973mmeEGWSdp7lO8pW7gIS15Y4/BqYduyNAK9KyDhY197q7lyfYTzTCjIykNC:Hr973mXvnKrgCWoLBs657cYmk

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3616 OpenWith.exe

pid	process
3616	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_nbt++.dll.a
1⤵
- Modifies registry class
PID:3996

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact