Analysis
-
max time kernel
62s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 16:30
Static task
static1
Behavioral task
behavioral1
Sample
3835e8a2e13cdc956e899722c716aa8de3ec23e05be727171d72c597515c7d83.docx.000
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
3835e8a2e13cdc956e899722c716aa8de3ec23e05be727171d72c597515c7d83.docx.000
Resource
win10v2004-20240221-en
windows10-2004-x64
General
-
Target
3835e8a2e13cdc956e899722c716aa8de3ec23e05be727171d72c597515c7d83.docx.000
-
Size
34KB
-
MD5
ea577d992b6d3b31f91158424f37a535
-
SHA1
bc7cc1e07903887d8741d1e5c64a33213525a92c
-
SHA256
3835e8a2e13cdc956e899722c716aa8de3ec23e05be727171d72c597515c7d83
-
SHA512
34712d13a23d29f7d9464cbf851b432cafa57f3856faba404bf5b2021d7fac778cf4fea099d476c7d6e5e68c804eb560e63cd67d626c0203fdacc2391c6513e8
-
SSDEEP
768:UHps/hwgW8+HEvXza68Rgn8lj+OhU4K4KAKr8L:UJs/hwS8uza68Rg8laOG4K4KAKc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1392 OpenWith.exe -
Suspicious use of SetWindowsHookEx 61 IoCs
pid Process 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe 1392 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\3835e8a2e13cdc956e899722c716aa8de3ec23e05be727171d72c597515c7d83.docx.0001⤵
- Modifies registry class
PID:740
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1392