Analysis

  • max time kernel
    261s
  • max time network
    265s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2023, 12:11

General

  • Target

    PvZ_Tools_v2.7.3/PvZ_Tools_v2.7.3.exe.asc

  • Size

    833B

  • MD5

    b79918d721f70fd14069e2aba5678d05

  • SHA1

    42cca4d5a32341415198ad8e9ed89da9d6d0321e

  • SHA256

    7c533f49568d6b9f9d4389c2eb9a13f9306a5fbe77778f9fa8ffdbec3f4712b3

  • SHA512

    3f328b420c1318c3f7f207b2995481fcf15756977e38b7df95dc36c6be067b4970309112193d1275a9a0430e0464f7902657b4f2031c2076ae9738577f6ba3b5

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\PvZ_Tools_v2.7.3.exe.asc
    1⤵
    • Modifies registry class
    PID:2276
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3612

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads