Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10/10/2023, 10:15
General
-
Target
baseline.profm
-
Size
1KB
-
MD5
e7116fe2e01a76b5c4eb2a7eb30db53e
-
SHA1
45072899183dcc29b1c6f8211490ef7227682e51
-
SHA256
c8b0a38d8cf11d518fcef6bc1cd47ee3d8e563910b83b2e469fd05d38b654034
-
SHA512
858158ba13b8198ae867155398ce6137e8b973086c163a11548e91b6f20538cd72a7d3196b32d9158ad5a75fe45229798bb9eb37b504f4dd1db5840923a7ac7c
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\baseline.profm1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5a579c5e9b91e5fa47cd8a387181f4ab7
SHA19d31aaf005300bec9881020d302815a027c91eba
SHA2564b46ff3c06a7f23c0e12de0e35a02eafdf4e08ec606feca1e6e3618f531dab2a
SHA51220d9a76f3a1b078ebec1bd2af233c625f8e664551863fa149a7dac6cd7486096f3d715326103e89452e5e330f018bce9948338cbfcd672f5bf0706f553d7e5ad
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB