843d5892ae16569f2b69899a9b344c4d8a36d441591006c9075c497a3bf7af20

Submit
Reports

Overview

overview

Static

static

tmp/.org.c...f.puff

windows7-x64

tmp/.org.c...f.puff

windows10-2004-x64

tmp/.org.c...5.puff

windows7-x64

tmp/.org.c...5.puff

windows10-2004-x64

tmp/latte-...d.lock

windows7-x64

tmp/latte-...d.lock

windows10-2004-x64

tmp/latted...colors

windows7-x64

tmp/latted...colors

windows10-2004-x64

tmp/latted...colors

windows7-x64

tmp/latted...colors

windows10-2004-x64

tmp/new.schema

windows7-x64

tmp/new.schema

windows10-2004-x64

tmp/old.schema

windows7-x64

tmp/old.schema

windows10-2004-x64

tmp/packag...pdates

windows7-x64

tmp/packag...pdates

windows10-2004-x64

tmp/pip/_v...rt.pem

windows7-x64

tmp/pip/_v...rt.pem

windows10-2004-x64

tmp/v8-com...s.blob

windows7-x64

tmp/v8-com...s.blob

windows10-2004-x64

tmp/v8-com...js.map

windows7-x64

tmp/v8-com...js.map

windows10-2004-x64

tmp/v8-com...s.blob

windows7-x64

tmp/v8-com...s.blob

windows10-2004-x64

tmp/v8-com...js.map

windows7-x64

tmp/v8-com...js.map

windows10-2004-x64

tmp/v8-com...s.blob

windows7-x64

tmp/v8-com...s.blob

windows10-2004-x64

tmp/v8-com...js.map

windows7-x64

tmp/v8-com...js.map

windows10-2004-x64

tmp/xauth_CDXAAy

windows7-x64

tmp/xauth_CDXAAy

windows10-2004-x64

Analysis

max time kernel
131s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2023 18:41

Sharing

Copy URL

Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

tmp/.org.chromium.Chromium.CIiP1D/4be5c8194aa6b4dce9271bdda525d0d8ba9b60b9fbee2b6ab9d7191bcf40deef.puff

Resource

win7-20230824-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

tmp/.org.chromium.Chromium.CIiP1D/4be5c8194aa6b4dce9271bdda525d0d8ba9b60b9fbee2b6ab9d7191bcf40deef.puff

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

tmp/.org.chromium.Chromium.YAQUpl/afdc25a3e878826efbf18a52aec0c7f46d621ad17c28722054bc30d1607e1215.puff

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

tmp/.org.chromium.Chromium.YAQUpl/afdc25a3e878826efbf18a52aec0c7f46d621ad17c28722054bc30d1607e1215.puff

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

tmp/latte-dock.mrkd.lock

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

tmp/latte-dock.mrkd.lock

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

tmp/lattedock-mvHtAR/default.colors

Resource

win7-20230824-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral8

Sample

tmp/lattedock-mvHtAR/default.colors

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

tmp/lattedock-mvHtAR/reversed.colors

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral10

Sample

tmp/lattedock-mvHtAR/reversed.colors

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

tmp/new.schema

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral12

Sample

tmp/new.schema

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

tmp/old.schema

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral14

Sample

tmp/old.schema

Resource

win10v2004-20230824-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral15

Sample

tmp/packagekit-alpm-updates

Resource

win7-20230712-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

tmp/packagekit-alpm-updates

Resource

win10v2004-20230703-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

tmp/pip/_vendor/certifi/cacert.pem

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

tmp/pip/_vendor/certifi/cacert.pem

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.blob

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral20

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.blob

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.map

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zShomezSmrkdzS.cachezSnodezScorepackzSyarnzS1.22.19zSbinzSyarn.js.map

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.blob

Resource

win7-20230824-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral24

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.blob

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.map

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral26

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSpnpm.js.map

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.blob

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.blob

Resource

win10v2004-20230703-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.map

Resource

win7-20230712-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

tmp/v8-compile-cache-1000/11.3.244.8-node.10/zSusrzSlibzSnode_moduleszScorepackzSdistzSyarn.js.map

Resource

win10v2004-20230824-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

tmp/xauth_CDXAAy

Resource

win7-20230712-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

tmp/xauth_CDXAAy

Resource

win10v2004-20230703-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

tmp/old.schema
Size

26KB
MD5

e02c98bc8c57de5bf4ea21be47ea645c
SHA1

9103fd70bc9eb39382507aae82c8c04d641fe166
SHA256

ca69296031d73576f5bba6b441ca3e05a388299e4e8e7e33db0299ea499a429f
SHA512

39f743abe7a7c4eeffd5a5572f109e288f4a8f5ea2528c32409d6087e3fe63689def68246de3ac8acfdaaf024c292a8bb077dda8f2e505bf293eacb3069622bd
SSDEEP

192:USmNuhGcUti6KtEYGjGUtHixBPHm1sqw44Clqi+1uiqRkCqD0EmoGpKZiteClOlb:UhNzbST6xtlpAyowAU2l

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1188	OpenWith.exe

Processes

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\old.schema
1⤵
- Modifies registry class
PID:3740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads