b92c73fd80d0356057d3b279d18e2ef7097eae67d0bf0ee03478f0bb19bef23c

Analysis

max time kernel
424s
max time network
1163s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

selfbot/tcl/encoding/big5.enc
Size

90KB
MD5

9e67816f304fa1a8e20d2270b3a53364
SHA1

9e35ebf3d5380e34b92fe2744124f9324b901dd3
SHA256

465ae2d4880b8006b1476cd60facf676875438244c1d93a7dbe4cde1035e745f
SHA512

ee529da3511eb8d73465eb585561d54833c46b8c31062299b46f5b9ee7eb5be473e630aa264f45b2806fc1b480c8ed39a173ff1756cb6401b363568e951f0637
SSDEEP

768:3kkmY4kD7HGJxYXIdjQWTGzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jj9:cGfKqIQCGzv8D7ksb2Ur79jj9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3632047111-1948211978-3010235048-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3632047111-1948211978-3010235048-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3296 OpenWith.exe

pid	process
3296	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\selfbot\tcl\encoding\big5.enc
1⤵
- Modifies registry class
PID:1788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3296

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads