Overview
overview
4Static
static
3Mercedes-B...al.rar
windows10-2004-x64
3mercedes_e...un.exe
windows10-2004-x64
1mercedes_e...lp.cnt
windows10-2004-x64
3mercedes_e...lp.hlp
windows10-2004-x64
4mercedes_e...ce.dat
windows10-2004-x64
3mercedes_e...ev.dhl
windows10-2004-x64
3mercedes_e..._2.txt
windows10-2004-x64
1mercedes_e...un.inf
windows10-2004-x64
1mercedes_e...lt.jpg
windows10-2004-x64
3mercedes_e...lt.txt
windows10-2004-x64
1Analysis
-
max time kernel
80s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2023, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
Mercedes-Benz W124 1985-1995 Service Manual.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
mercedes_e_class_w124_1985_1995_mult/Run/Run.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
mercedes_e_class_w124_1985_1995_mult/Run/help.cnt
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
mercedes_e_class_w124_1985_1995_mult/Run/help.hlp
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
mercedes_e_class_w124_1985_1995_mult/Run/interface.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
mercedes_e_class_w124_1985_1995_mult/Run/mev.dhl
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
mercedes_e_class_w124_1985_1995_mult/W124_2.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
mercedes_e_class_w124_1985_1995_mult/autorun.inf
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
mercedes_e_class_w124_1985_1995_mult/mercedes_e_class_w124_1985_1995_mult.jpg
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
mercedes_e_class_w124_1985_1995_mult/mercedes_e_class_w124_1985_1995_mult.txt
Resource
win10v2004-20230220-en
General
-
Target
mercedes_e_class_w124_1985_1995_mult/Run/help.cnt
-
Size
423B
-
MD5
854611681197ec1014e68615fc05e63f
-
SHA1
e68f3f8b156f36786de71bd38b9c6fea6cdb6313
-
SHA256
cc48373f4b3df5a8f307f7742199a184b1f6c61f88fafb88c6d05ca5fe89b86b
-
SHA512
27deb8755f2627876afcf765fb2fd648b4aeb527b08871b1efd23685e5730151aaaaca0be280e9cfb57479d039fa7d1aaf378418b88d3a877d16e2f8081405ff
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3168 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mercedes_e_class_w124_1985_1995_mult\Run\help.cnt1⤵
- Modifies registry class
PID:3980
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3168