9683a68a42f58c795eef04beb0fdc6cd23606ceaf149d509d17a9522439349c5

Resubmissions

20/02/2024, 22:04

240220-1za6zsfe8w 1

20/02/2024, 19:59

240220-yqlv1sec6t 1

20/02/2024, 19:50

240220-ykgzwaeb9t 7

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

railway/object/linea 4/avenida 4.b3d
Size

232B
MD5

df04233d837ba0496649aa4c343fc0cf
SHA1

67c686f618692aa3dd931b8795c96c3578f23e55
SHA256

71c0ed3b326e2afe0830633f8e1265d89faf9871496a2cdfedb6b50bffffbc62
SHA512

1dec3a3202157233179d6bf606e1384ebc46a4bf305f9280781b87447532c33e9f4c3ff30e802d218b5a069175426bba5a51c4720c952fb82f1a3602bb88186e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1888637039-960448630-940472005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1888637039-960448630-940472005-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4452	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\railway\object\linea 4\avenida 4.b3d"
1⤵
- Modifies registry class
PID:2224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads