c68bc9a30b8a932dbbeade659b6215fde169a9860e9f454b545e16605aba6d2f

Resubmissions

18/03/2024, 16:24

240318-twgq2ach99 3

18/03/2024, 16:15

240318-tqhq5sdd7t 3

Analysis

max time kernel
109s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
18/03/2024, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mappack.rte/Activities/BrainVsBrain.lua
Size

32KB
MD5

6a19ab6a0a0338a46f7c4cbd9675a18a
SHA1

d819a15ddd708fa4539d77ca8e12225055c1f5d9
SHA256

14da7b1adb7ce2a38f5882d18250df562555edb44a9ca3db0626e4d0cf80bffa
SHA512

9c999b688ad87ea8311f279964f12f598214673149041d65258ff71951b48859b3a8cf70b5a5dbc13aa1274a9217e9b3745b9989c498e1ea4babbb5c195b4b3a
SSDEEP

384:BoWq5+AIfIK3X5S9D2oiCcKopo7RjGXSitxoApNvAfFnIRkU/4Pp1cpAGnIRkU/f:BVq5cAaXA9SoiCc2RjG7tuAXvAp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2996	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Mappack.rte\Activities\BrainVsBrain.lua
1⤵
- Modifies registry class
PID:4904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads