6d192fbf295a7505ae7fdb872f12465b79931c7284ab21bc493bc3a118ae844b

Analysis

max time kernel
129s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/obs-plugins/frontend-tools/scripts/url-text.py
Size

2KB
MD5

982319dc7736f0a7f753cdec07051cf9
SHA1

4f86b3f856a518b0ae9ab0e70895d55074a2057c
SHA256

178aafd7c5c2188fc509805c4651ba248b2c55b26aaecb2ac445e5477bf4e2f3
SHA512

2d15b74d6c53ec5eae4f4983ea35379c1c5781d2ca7280320114a166b181742e60c9e68acf6991f30b4a0f6c9e7afbde7b7c62cd132207450c39b95e4def401f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4232	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\obs-plugins\frontend-tools\scripts\url-text.py
1⤵
- Modifies registry class
PID:3920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...