6ae1a778523203660d1c300dfca88c14e2ea012e417a31238f6b312cfc3902f1

Analysis

max time kernel
377s
max time network
1591s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2023, 23:47

Target

firefox/gmp-clearkey/0.1/libclearkey.so
Size

94KB
MD5

97767613b4f8795de2099e0f58acad98
SHA1

6aab8591147c2cf6af3561b3774361292ec080a0
SHA256

c2637dd3ea2bf3abf74f11be6ace4c16d6b5b6b545cf5bedd69d2690fcc1b36b
SHA512

131691cf21b123f7d9dc3202234e0854bb471a78d637750717fd1c2b34dc5ecbb837f0268b04b0e2b0ac2a678fca012c23851e6177251591c3416e480274afe0
SSDEEP

1536:SabSX0KofgfnHWi/kn6JJDFlv1s6LikwxaOBrBPAHtgXqki3tMQ2qLbKu:SAS5oWnHWD6JJDj2DxaOBrBPAHtgXqkZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\firefox\gmp-clearkey\0.1\libclearkey.so
1⤵
- Modifies registry class
PID:3924

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact