Analysis

  • max time kernel
    102s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-08-2023 23:34

General

  • Target

    TaxHeaven3000-1.0-win/lib/python3.9/chardet/langcyrillicmodel.pyc

  • Size

    28KB

  • MD5

    86d2b520869c04fc50305c8c7f2b6970

  • SHA1

    9e430b6b349b642cbe3e41535b16618ad69ff9dc

  • SHA256

    08e7fe901247bb80cd4b3ba755fdda2a948397ad5c3ab54cc34c609f44db7078

  • SHA512

    d91cb2d7efb4a7e8798a4e958e2906464083ee1cadfc3d93b61259ac393c4fb8f3102d4bb1bf766ea20660a3c8f5818f14275374dc4370f64d67c9de3795943d

  • SSDEEP

    96:Wu5leX5DB/bB199i9maM299i9lyaF99Q9ma1P99wta1TH0997G9wadLbFZJB9rlK:WIlqBX9wx59wzF9OxB9OITH09ELLCSM

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\TaxHeaven3000-1.0-win\lib\python3.9\chardet\langcyrillicmodel.pyc
    1⤵
    • Modifies registry class
    PID:3856
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads