047758fad4c08391983353e9aef6b934c9fe4e860d63a0f6908aeb44427924aa

Analysis

max time kernel
52s
max time network
60s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
31-03-2023 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a/B.class
Size

2KB
MD5

ff3d7b022d9a8c6cb557b8ff7cb5e7bf
SHA1

da29bda243cf1bf76e75b107415ab997b2fc8690
SHA256

bacdaa856875ab1225bbf95377bddef5e0bd9771914c6546d48fb538b3959d9f
SHA512

d9edec14468b66813d46db1f5e495da1c2d9257e5e46790f9bb2da062e237e72b939f5a202575f5d2ecc1d205a16ab3685255012f9cdcac27d3db2b77f129988

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4400 OpenWith.exe

pid	process
4400	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\B.class
1⤵
- Modifies registry class
PID:4092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads