Analysis
-
max time kernel
53s -
max time network
69s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-06-2023 16:02
Static task
static1
Behavioral task
behavioral1
Sample
Nový textový dokument.txt.vs
Resource
win10-20230220-en
windows10-1703-x64
5 signatures
150 seconds
General
-
Target
Nový textový dokument.txt.vs
-
Size
43B
-
MD5
dc8a33c9e7bc143facd1fba3ff81c20a
-
SHA1
0840d1cd2ed03714c765b297f831bdea6d56956c
-
SHA256
b29f9f6f7cff2de77f57efad229da6879e7efff691f9e3d8b2c684a0aa0dba1b
-
SHA512
3f65e0e76f275d7d8acbaa965158cfb50db34cdb0accfa97f55af01d643b8c5906191f655d6f2f08de70c2125dfe5f5849152ed472fc671ba26e0dc861ff0d34
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2316 OpenWith.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe 2316 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2624 2316 OpenWith.exe 68 PID 2316 wrote to memory of 2624 2316 OpenWith.exe 68
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Nový textový dokument.txt.vs"1⤵
- Modifies registry class
PID:1920
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Nový textový dokument.txt.vs2⤵PID:2624
-