bf2ca3f940fe084a409d7889de8b32b29842106b5112684e0c98facf9300bb9d

Analysis

max time kernel
583s
max time network
620s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)/cfg/tms32028.cfg
Size

463B
MD5

c84e93e2663ea09e550ae7cfdb5c5f9a
SHA1

807e37207331a1ef8d6fdb341de5bcc3fe3375d0
SHA256

d9eeafb2ad99f55d821377618c9c30546a27046b0ae05ad1de46a863d1886ed0
SHA512

17b0c52df2e4d763ef4d259c1591ff22fe6236de98aaf0083bbe93d42a94fa44e147c27a5deaf6407475bb977cc99f8cf54d2a58c183468085b89f2c5618c848

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1124 OpenWith.exe

pid	process
1124	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\cfg\tms32028.cfg"
1⤵
- Modifies registry class
PID:3332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads