3bf7b10d9960ff916bf58592dd1981fbe6a3be73c1cf9e57d564402652a18b62

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16a75bacfd82a05161928b7c5418b23f.exe
Size

363KB
MD5

16a75bacfd82a05161928b7c5418b23f
SHA1

49017ad75509a76480c8b61a49d7f5bb67bb5a72
SHA256

3bf7b10d9960ff916bf58592dd1981fbe6a3be73c1cf9e57d564402652a18b62
SHA512

362d9ec783508e55d90cf27e45b72cb10c5f168021293f37871d45a0d49bfb45a509b0f94597526b284f6bac879d7970d24c50905daf7e5e8785fd6b6a3bf42e
SSDEEP

6144:QRMeGsWuyp2TgwtwSDGYwgGjgx2GKLfXL7wNzv9q8Woq62a2yulov7rrkcaAiIEo:Vc912gaf7ENzilydnE/VC

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\0.exerer	16a75bacfd82a05161928b7c5418b23f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	16a75bacfd82a05161928b7c5418b23f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2396	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\16a75bacfd82a05161928b7c5418b23f.exe
"C:\Users\Admin\AppData\Local\Temp\16a75bacfd82a05161928b7c5418b23f.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-2-0x0000000000400000-0x0000000000401080-memory.dmp

Filesize
4KB

Download