0f123d682b897bd0e86fe283e2037688ce11dd07f2a6a3f214ab67a0724af757

Analysis

max time kernel
137s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_20220209_162041.jpg.ppvw
Size

3.1MB
MD5

cf67fe997e85aff3d446272862a342a8
SHA1

2f4442a734ecc7633e651b1872f03ec20e50ed02
SHA256

0f123d682b897bd0e86fe283e2037688ce11dd07f2a6a3f214ab67a0724af757
SHA512

6487709ec6390e3d537362983d1e550d69d8aadf76c2405ce6f3b61e8c04e535193a2d11cecdfe7a434818930cc1f48625c8d85dc17194e1deb317ecb25379a6
SSDEEP

49152:ozrxgLsZH+p3aoBQAKPIfN/RN3umGO074MpJE26p98OKXL+nYE4nI0S7Q:mxgTpKsQUl5NeN8MbEN9JKXqH2MQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
820	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20220209_162041.jpg.ppvw
1⤵
- Modifies registry class
PID:3856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...