d3b36699e352553847cbf3c4f81dc3824c517f3dc8648d143b4a04547cecb854

Resubmissions

02/01/2024, 19:59

240102-yqp8fabdej 5

02/01/2024, 17:26

240102-v1ac7addb7 3

Analysis

max time kernel
327s
max time network
333s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

img.jpg
Size

294KB
MD5

b2de127f4dd40c4640bd3467cc5935b0
SHA1

af04aedca1bc8ae320f4963213a0a41c302f23c9
SHA256

2397654cbbe68dab76603837186acc86fe2d7470a0d0a9992ce64cbd73901081
SHA512

c0f5fcb12bba4c445d4c3b35fb44b3780f6ef210d8a40775fe73370097f470fb5f102fae61cbb6066717663dc807881112c292c52b379c561e51537160dd4794
SSDEEP

6144:FH8x/SdVO1WefRngf+w2+IkppHtp0hP5BdcfNHpyNVbN71JDPvtcyMs1:1C/SfYdgf+w2pepHvEP5Bd8Gx73Pvos1

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
404	mspaint.exe
404	mspaint.exe
4640	mspaint.exe
4640	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3868	OpenWith.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
404	mspaint.exe
3868	OpenWith.exe
4640	mspaint.exe
3488	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\img.jpg
1⤵
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1728

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\img.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3868

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\img.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3076-11-0x0000026325EB0000-0x0000026325EB1000-memory.dmp

Filesize
4KB

Download
memory/3076-17-0x0000026325FC0000-0x0000026325FC1000-memory.dmp

Filesize
4KB

Download
memory/3076-19-0x0000026325FD0000-0x0000026325FD1000-memory.dmp

Filesize
4KB

Download
memory/3076-18-0x0000026325FD0000-0x0000026325FD1000-memory.dmp

Filesize
4KB

Download
memory/3076-16-0x0000026325FC0000-0x0000026325FC1000-memory.dmp

Filesize
4KB

Download
memory/3076-15-0x0000026325F30000-0x0000026325F31000-memory.dmp

Filesize
4KB

Download
memory/3076-13-0x0000026325F30000-0x0000026325F31000-memory.dmp

Filesize
4KB

Download
memory/3076-4-0x000002631D360000-0x000002631D370000-memory.dmp

Filesize
64KB

Download
memory/3076-0-0x000002631CBC0000-0x000002631CBD0000-memory.dmp

Filesize
64KB

Download