Analysis

  • max time kernel
    50s
  • max time network
    67s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/02/2023, 16:37

General

  • Target

    it/dado997/BossMania/Commands/PageableCommand.class

  • Size

    1KB

  • MD5

    4c22cc1826584b464a4163d8038b3197

  • SHA1

    319ce83242d0c5dd73f9bec47b6c084bd3b6296d

  • SHA256

    ef6b61796ca8e864dc9e3fff8b67bbc01a4ece6e093ac9341091f4195ab54910

  • SHA512

    6fa326fc71ecf9122fe41ffdee25b6c8056378c973e0fb5941e44c279698177bc30f53d6eb83a4da439d9c921741d64336034d34770fde1baed44dc63e8be1a6

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\it\dado997\BossMania\Commands\PageableCommand.class
    1⤵
    • Modifies registry class
    PID:4796
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads