b67525bc7bd67a1828012580601147bc094e7724099158b753360f3b29329541

Analysis

max time kernel
235s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ragib's Website Project/font-awesome-4.7.0/less/icons.less
Size

48KB
MD5

bf95b901c36b646ff457379bdcda94b7
SHA1

0285a999eb1adad868366678c2d9365b77186a45
SHA256

4d585eeee98f4826c547e030a690690ea56a4dede806fc8176342abecd06fea1
SHA512

8735bbdc8c7c9d082c2a1f261c74bed575fa096ba8775ad48ada6894f03a8319414db099395e80f16f6e89d802c988c1a2bbf73252c65acb040c35d40b9ed0f5
SSDEEP

768:WP8AzES3MVYrbh8brm3rZkMArAvpDDVpLUy:A8AzRGbeVDArAZLh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3276 OpenWith.exe

pid	process
3276	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Ragib's Website Project\font-awesome-4.7.0\less\icons.less"
1⤵
- Modifies registry class
PID:4440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=3136,i,3192284747741020952,1225278682167953346,262144 --variations-seed-version /prefetch:8
1⤵
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads