Overview

overview

4

Static

static

1

main.py

windows11-21h2-x64

4

Resubmissions

07/03/2024, 12:55

240307-p51s2sbd88 4

Analysis

  • max time kernel
    107s
  • max time network
    108s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/03/2024, 12:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    main.py

  • Size

    4KB

  • MD5

    5ba9eea7ee1006f3e40c16905e0bfb34

  • SHA1

    a3f26fe1b03217b83a073034e8aa7f8c3fb87339

  • SHA256

    6df549156113030ee09375a71acd2246ee236ad585c3cb9592d0e07ed699ada6

  • SHA512

    3732a8c6abe4a1897cd38f52088736b81fedba618accfb3d81416a9e7fa7e6c5bfc4754271f9cc274b5b1df7c79a89dd6345cd6727acf2bc642a7d994cf5e96e

  • SSDEEP

    96:jla7HrwVKiHhycbSKrQ92almxexeLQOywdNjqgbgTWu:A0EoS79jlmxexeLQBwdNxu

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\main.py
    1⤵
    • Modifies registry class
    PID:4920
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4992
  • C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\RevokeCompare.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
      PID:5052
    • C:\Windows\SysWOW64\werfault.exe
      werfault.exe /h /shared Global\64b0e91557d540d88474b4a8e7ddf962 /t 2112 /p 5052
      1⤵
        PID:4128
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
        1⤵
          PID:1916
        • C:\Windows\System32\oobe\UserOOBEBroker.exe
          C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
          1⤵
          • Drops file in Windows directory
          PID:3104
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
          1⤵
            PID:3468
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1332

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                  Filesize

                  10KB

                  MD5

                  eebfb84605e05222e3ad98f4b9f62db2

                  SHA1

                  36ddd440df5b2776281ad245a6a57e7a183c09a0

                  SHA256

                  4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559

                  SHA512

                  90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6

                  Download Submit