90e2d50df5ac5b437e21ed7f744bb1bbfdbec751e2093cf497c166cd43acc59d

Resubmissions

26-05-2023 11:29

230526-nls4esfb93 3

26-05-2023 11:27

230526-nkymhsff8z 6

Analysis

max time kernel
383s
max time network
440s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
26-05-2023 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Evon/version.data
Size

24B
MD5

b786ff22cdc18dfa474ec354bc428613
SHA1

89e67d86bc068bf66c0ee46832a53898bf7919ef
SHA256

6fdc2a68633e2d5c39d53894fe0fc6770aa27465763872e8fb94dbc0fab1c610
SHA512

7fbdf84bac27a3b75694a952ab4942c55e4aedcfcb176cb6ff0b00909161a4ab9f45d52a1c3d8caa34ba8a6e988f6f2a413c0e65138eb3bd5eb6f75fca05dea4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4992 OpenWith.exe

pid	process
4992	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Evon\version.data
1⤵
- Modifies registry class
PID:4148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads