902cb042ac5819893b58e13bb275f8340e365bb00275647ed038630b4f8f9c2e

Resubmissions

13/01/2023, 15:22

230113-sr9qkshh37 10

13/01/2023, 15:15

230113-sm889ahg86 10

13/01/2023, 15:12

230113-sk86gade71 8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord Nitro Generator.rar
Size

2.1MB
MD5

1272913903f006257782576e54bc42f1
SHA1

2f0de1263f81ed61aed30911322ef0d8afeac200
SHA256

902cb042ac5819893b58e13bb275f8340e365bb00275647ed038630b4f8f9c2e
SHA512

e993bd3577f118f6aedbbf858f16caa15810852d9ea0f9c688d1a35b234764e32642dbf779b7722afc023b42c9d4ef4a53925abd7ee44e1896023c001edb849d
SSDEEP

49152:sw6z18UZYwYHEDhCOCTLbANtfZRpL5/oRlLjvM3:FkXeBCSTSBp/yxq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.rar"
1⤵
- Modifies registry class
PID:4956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads