bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e

Resubmissions

02-02-2024 14:59

240202-sc227aggd2 7

02-02-2024 14:53

240202-r9dkesahcq 3

Analysis

max time kernel
414s
max time network
420s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iKernel.rgs
Size

25KB
MD5

4df94a4c0cd342707098e6662325dbf8
SHA1

a69aaf162e6a2081f25c8b8976168306a2b5a8ee
SHA256

657148f0d0f043ef3e62c7c7ab0578147025edcf59431f2055b45dbd8ac673b8
SHA512

07f6ac2751679702b460cdf3d6b4b6821244c5777a6cbed7785ccb4fd057c42f361ace9c9017a47b1c01d3c8a01f161de479306985d27f6958ae8c2d40084836
SSDEEP

96:FQsYSD9hdM6piTwIBwDrluPnT1JO2dLeZd33GhYcbatByBH9RLVxnRIo5tW2WzWk:FTGrBGMJtqBnK3vK164J3PMi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3608 OpenWith.exe

pid	process
3608	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\iKernel.rgs
1⤵
- Modifies registry class
PID:4348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads