76abf90f3575a023b53226ad1e4a3fe46eb409450a99ad97e53eed1912ade9cc

Analysis

max time kernel
147s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EA DLC Unlocker v2/setup_linux.sh
Size

8KB
MD5

1742976191440d52facbcde93b399a94
SHA1

8e0090b551df1c0b37b8f9537f3e193381c39aa3
SHA256

45151c83b0bded55a2fb8d1c3b6dda97940c40fe75dd1c7241cfde1e355008c6
SHA512

8f53eabf8432328d161cd856d2097a0a16b16e1d29447576fcb951cd5027fa2411570094739794a674bf70dff29aed1e9e25e55ab72b74fffbf45e0429466918
SSDEEP

192:4tRspvH+Ra0ixVqBcARgIRgnS0/VzoKiMeXMgditLwdVOIt1qGWjA8PSkGxibXdJ:4ty4mKfGrYVOPc86kzXdb92fc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4648	OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe
4648	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 2140	4648	OpenWith.exe	98
PID 4648 wrote to memory of 2140	4648	OpenWith.exe	98

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\setup_linux.sh"
1⤵
- Modifies registry class
PID:468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\setup_linux.sh
  2⤵
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...