c997f718eb93d92c99bc9c530d5c9fe386562aa061e8b123d332c86675525f05

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2023, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

horizon.rar
Size

1.3MB
MD5

3ccb4cc857dda9d746a04d2998d5945f
SHA1

ec179fa38820a54d9c7f6444d20ea13e4240ee56
SHA256

c997f718eb93d92c99bc9c530d5c9fe386562aa061e8b123d332c86675525f05
SHA512

99c43fe257c3507b3e4fba52a4b5431bfa9dd0a702f6d7cd91559c5f26b0821ce686e138d563424e39fa0187d1113ba52245830627aaf2e32a5d989b89240d75
SSDEEP

24576:VrATxdDgfzEJXGTGkW1kSg7r5n/lKdmvKIiBDjf5xyPoWTImxCZmmJA:BodDgfzq2CkuGH5/USujryPzTI8Ge

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4124	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\horizon.rar
1⤵
- Modifies registry class
PID:2108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...