Analysis
-
max time kernel
125s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
07-09-2023 14:38
Behavioral task
behavioral1
Sample
spoofer_midnight_scpsl.exe
Resource
win10-20230831-en
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
6669999 (1).pyc
Resource
win10-20230831-en
4 signatures
150 seconds
General
-
Target
6669999 (1).pyc
-
Size
2KB
-
MD5
727d8ce363c068de369b9e3ad3f0e991
-
SHA1
9706e9d3f18964362ce7e8668d33885ede6bee7f
-
SHA256
df001d3cdaccee82d77e4b675c2ad91c845415918535dcf10402d6340dc6073d
-
SHA512
753e14722131eb2811a1e469adf4823403867af3ec2ab32db7b5b65f13c3b27bf68ea84c664499734f67567f5a58ef9dac3c2a101cbc4218b2a7dbcf129d1ec8
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3618012334-189558363-1282585034-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
OpenWith.exepid process 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe 4468 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
OpenWith.exedescription pid process target process PID 4468 wrote to memory of 2192 4468 OpenWith.exe NOTEPAD.EXE PID 4468 wrote to memory of 2192 4468 OpenWith.exe NOTEPAD.EXE
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\6669999 (1).pyc"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\6669999 (1).pyc2⤵