61859a2460b667071ecd47bb30206247afc972d6a02f5932d827057734347133

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newhotmail/hotmail/no_recording.php
Size

15KB
MD5

1831f780efe63c0f29f8c169a4adcca6
SHA1

c38dfe858ea79c5b2558494e11581018e9f18a95
SHA256

e859ed0b4d03506fb4e0761e5149483817c19f899580d3c094014f22276b4fbc
SHA512

08acaee40f2cb2bdaae3a08c82e1daa5474524526957dd7627e37cc29b863474262593dafbbcf6124772097c8e24dae38e15ee8426c173e1d5063535c38350ca
SSDEEP

192:7roZz/hlAnhCVRc6xbopf2KhFtZMOWxyzhtdSOC1LNROPSYYLuLIjYhEmuEg5Ipy:fMl4oRXK28y1yzYKLI0hEmu3fo2j

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

876 OpenWith.exe

pid	process
876	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\no_recording.php
1⤵
- Modifies registry class
PID:3588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads