Resubmissions
18-01-2024 21:47
240118-1m8ayshghp 318-01-2024 21:42
240118-1kd94ahgdk 118-01-2024 21:39
240118-1h5dhaafa4 1Analysis
-
max time kernel
205s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18-01-2024 21:47
General
-
Target
Transfer/locale/ar/freeplay.cfg
-
Size
751B
-
MD5
d53a82bf003dc19bda5bc3312cc7ed54
-
SHA1
7e114080dbe7389d607d53b3537f926ddbc604b9
-
SHA256
c0d8040d7121de9ce62ffacafff114265f6e0df54edcd186c28f628bfcdae95a
-
SHA512
53446e6b16ee495d3a138df5f6692672ed6469106e9af75431afd0095d8cf21a9fa9644d596affa7b81587eba8cc3d51048c4d78a39183df67ff14940646f23d
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Transfer\locale\ar\freeplay.cfg1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB