c957a90383e4d564c8c6ceb04542111a4b6bd3c971139f2cf8c5b684efb891d4

Resubmissions

20-04-2023 22:26

230420-2ctv9aee91 8

20-04-2023 22:23

230420-2at38see9t 8

Analysis

max time kernel
1619s
max time network
1592s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2023 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FullSetup_Use_2023_As_Passw0rd.rar
Size

9.7MB
MD5

3f58f164c8d52e5e69f744a9d2f4a36d
SHA1

c481a9a792fbbf2413d45d767de99bf1d38670be
SHA256

c957a90383e4d564c8c6ceb04542111a4b6bd3c971139f2cf8c5b684efb891d4
SHA512

0bd2af2e9a31d2599a33a578bfa32166427278b1631389de28cf2dd059f8ed0fbb4d9ae1dff5026783d82e6c597d247128921c88f96164d3516d10e2d3742f5e
SSDEEP

196608:X/wITD5OJo/1DNtksXtfLByATvtCg48gzZbe6yJlmWR3165g8uMYi:X1xAoNx99pTVCHzZbaJlmWR3xi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FullSetup_Use_2023_As_Passw0rd.rar
1⤵
- Modifies registry class
PID:2156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads