a1962d9109023ef685d8c52ef137a011965bbfa69ec72b44757d29cd9cbfbd24

Analysis

max time kernel
366s
max time network
887s
platform
windows10-1703_x64
resource
win10-20220901-es
resource tags

arch:x64arch:x86image:win10-20220901-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
09-01-2023 00:46

Target

UltimMC/libLauncher_nbt++.dll.a
Size

149KB
MD5

4f7a4739f156d3073f9f8de0aa7afc67
SHA1

31e07c7d9d9a52148f831bf2dbfea95ff682a81c
SHA256

6c1d40e271fc60309ca611fdc60ab8223a9582e107de6c7b36941769c3412c4d
SHA512

4eb2ca755c11e9150c8b70f1f2603179896a7196ad832300088dc4ff9e08f41cac7e49732bf4b6e7c5ddaf156a1a0771006079e58d9e96f354e28bdfa0eaf84c
SSDEEP

768:WPr973mZc80KgpCzLG6B0zuEfZbAuz3uOZBufYKnKuDzU/F6yhNE3GvFbBvmKCFV:yr973mXKuKrgEAgVpxc57UYma

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2740 OpenWith.exe

pid	process
2740	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_nbt++.dll.a
1⤵
- Modifies registry class
PID:2596

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact