Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2023 18:41

General

  • Target

    tmp/.org.chromium.Chromium.YAQUpl/afdc25a3e878826efbf18a52aec0c7f46d621ad17c28722054bc30d1607e1215.puff

  • Size

    12KB

  • MD5

    fe602b04d541015f9d62d4d3ef165ce2

  • SHA1

    b8f2f63b7408d2c1ce3d133a2ee2b99def2f45b2

  • SHA256

    afdc25a3e878826efbf18a52aec0c7f46d621ad17c28722054bc30d1607e1215

  • SHA512

    fb26fef1195837123198e6ce1e0a405ae30a7e60bf6a43bb09faec9d030e11f08ac461858374240c5bd1de1bd8a40454eecb3c8fa92de207a6114fd3b588e0ec

  • SSDEEP

    192:Lh7U7Icc/zTWAgjI8YqT0qagCKdCQA087lzUIKcOEPIJlZCoCqK8:Lh7UscogLYqwLgVdbA0YlfnSloa

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\tmp\.org.chromium.Chromium.YAQUpl\afdc25a3e878826efbf18a52aec0c7f46d621ad17c28722054bc30d1607e1215.puff
    1⤵
    • Modifies registry class
    PID:3496
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3376

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads