da24966b2d4057afc7c0a4910ad0c37c360573866037712cd488b696244e1a20

Resubmissions

08/07/2023, 07:03

230708-hvrdasea2w 3

08/07/2023, 07:01

230708-htqqdada27 1

Analysis

max time kernel
102s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.tar
Size

118.5MB
MD5

dd6b91364c768fb695d050af838cfd66
SHA1

2b01a57d8ab145a8ce550c788c47791c2c42d8ed
SHA256

34bab9b7405b9a6cb891218c72b4b22cc74521436d96a57e4dd9b5c26daf5cf3
SHA512

60ac64d19f8466ee02ce19b0a95382ad8f82b3a480b43518bb79df05787eee2d283247e483f5d215d1cb20fde07f09bde8b10528e196972ab87119d45db214e1
SSDEEP

1572864:EFlPNePr10q1vo8T5SnMp8dRlfC3KsRfOswBgFNBmy2yyq32M8l7uBfjG6d4B6cP:OQR0q1l5SnMuRlq3K8PbBmy2yCM8ssV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1088	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar
1⤵
- Modifies registry class
PID:5056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...