Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20231128-en -
resource tags
-
submitted
09/12/2023, 22:54 UTC
General
-
Target
Spoof/WindowsFormsApp2.exe.config
-
Size
929B
-
MD5
2461fef5b61855125a31e3eeec83ea99
-
SHA1
e1c82f24d87e4ea79829f83cfb9b1b844df41613
-
SHA256
0d5a868ba40b717256b2b0d2d91b6771a2efe5e139079bcb7dd11d1039b3bc6d
-
SHA512
ba3eff240d48eb606043a9d5fd596289bfa600430508525768e928eba278319c35bf09dc4ad6579a7fd3ec8d2c5e18932d017db10696f64a034027909d227bc3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Spoof\WindowsFormsApp2.exe.config1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdcus14.centralus.cloudapp.azure.comonedscolprdcus14.centralus.cloudapp.azure.comIN A104.208.16.90
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEwu-bg-shim.trafficmanager.netwu-bg-shim.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A96.17.178.180a767.dspw65.akamai.netIN A96.17.178.194
-
DNSocsp.digicert.comRemote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
DNS90.16.208.104.in-addr.arpaRemote address:8.8.8.8:53Request90.16.208.104.in-addr.arpaIN PTRResponse
-
DNS180.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
11.227.111.52.in-addr.arpa
DNS Request
self.events.data.microsoft.com
DNS Response
104.208.16.90
DNS Request
ctldl.windowsupdate.com
DNS Response
96.17.178.18096.17.178.194
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95
DNS Request
90.16.208.104.in-addr.arpa
-
8.8.8.8:53180.178.17.96.in-addr.arpadns
DNS Request
180.178.17.96.in-addr.arpa