aef4ca95d9fc89f2a33079e795d51f54ea6c2ae74430cd3cd65f0578a6cfcfd1

Analysis

max time kernel
1614s
max time network
1624s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
26-03-2023 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AridekVM 26-03.rar
Size

12.8MB
MD5

5818b3e61004f0746e274a4c9d4cbfb0
SHA1

6f19170af971be23b1342ef069e2ddae1c06d150
SHA256

aef4ca95d9fc89f2a33079e795d51f54ea6c2ae74430cd3cd65f0578a6cfcfd1
SHA512

26f55b47e2faebda912486a4a5ef857b0ff8f6e7e3713c282a14190bbe4607eba54f7fffb6d71fe4c6b621e85c7dca781fd2a3131df66cad3be3e3f083aeb84d
SSDEEP

393216:ekU2WrPtfVBjtJOHQeu4faF4Lv7ed3Dij/JV6VfMjl:g9ZVzQZuYayHed3D4TsfMjl

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

OpenWith.exe

pid process

4308 OpenWith.exe
4308 OpenWith.exe
4308 OpenWith.exe
4308 OpenWith.exe
4308 OpenWith.exe

pid	process
4308	OpenWith.exe
4308	OpenWith.exe
4308	OpenWith.exe
4308	OpenWith.exe
4308	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AridekVM 26-03.rar"
1⤵
- Modifies registry class
PID:3744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads