f8a2c7bf6611cc965e76f1286fc460ec47f3d7e4353877716417cd8b553b2667

Analysis

max time kernel
1504s
max time network
1474s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locales/ru.pak
Size

214KB
MD5

a953b6e38d0e545575b842fd46292755
SHA1

17e15c48ef172375b6d7f26a16ad0332ecf85c84
SHA256

81d1befb25506720d1f336b18a586250ef1c4b389f58eb573784a0ab585f92d3
SHA512

b227f9ab64f0c22080708ffc4ffbba51cf022ee37a1ce9cd82dd06dd58ad12292d6a274badf8f1f27e5f42dcc5b9523e3fee254c02abd1d0844be61a3a713634
SSDEEP

6144:gEaX+/KuMHVOorn+T52wdOrsL489QgIv7RW9o3MfZyLv9YxTYDdVxPA:gEaX+/KuMHVOorn+T52wdOrsL489QgIa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1748	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\ru.pak
1⤵
- Modifies registry class
PID:3188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
88e02ea5ec9d8f98b4c12d433823905e

SHA1
5ef16460478b3a05456ac4bb6a4ffec6b804a0ef

SHA256
c8b92e478882324a338760b70afe8743d9ed35dcc4499d4865196f9f17afcfd4

SHA512
333c7082bcc43bebf9ff68101981410eacc89fed707f8ed709f5fb8567a0f2db9108e4dc2bfd9be5be64a5dc0f8472baf35b270e9b30ac792f9ba11a1083d9b8

Download Submit
memory/1748-40-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-33-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-42-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-34-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-35-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-36-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-37-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-38-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-43-0x00000258347B0000-0x00000258347B1000-memory.dmp

Filesize
4KB

Download
memory/1748-0-0x000002582C470000-0x000002582C480000-memory.dmp

Filesize
64KB

Download
memory/1748-68-0x0000025834A00000-0x0000025834A01000-memory.dmp

Filesize
4KB

Download
memory/1748-32-0x0000025834B60000-0x0000025834B61000-memory.dmp

Filesize
4KB

Download
memory/1748-39-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download
memory/1748-44-0x00000258347A0000-0x00000258347A1000-memory.dmp

Filesize
4KB

Download
memory/1748-46-0x00000258347B0000-0x00000258347B1000-memory.dmp

Filesize
4KB

Download
memory/1748-49-0x00000258347A0000-0x00000258347A1000-memory.dmp

Filesize
4KB

Download
memory/1748-52-0x00000258346E0000-0x00000258346E1000-memory.dmp

Filesize
4KB

Download
memory/1748-16-0x000002582C570000-0x000002582C580000-memory.dmp

Filesize
64KB

Download
memory/1748-64-0x00000258348E0000-0x00000258348E1000-memory.dmp

Filesize
4KB

Download
memory/1748-66-0x00000258348F0000-0x00000258348F1000-memory.dmp

Filesize
4KB

Download
memory/1748-67-0x00000258348F0000-0x00000258348F1000-memory.dmp

Filesize
4KB

Download
memory/1748-41-0x0000025834B90000-0x0000025834B91000-memory.dmp

Filesize
4KB

Download