208673224933c0afac03ed353d00261e836d96395eef6f4910770c5e471333ec

Analysis

max time kernel
1763s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

encodings/cp1006.pyc
Size

2KB
MD5

3d4e647ce37785acb94389d4128a3d9e
SHA1

7239dc87e9347e2157e5a15a8baf93b8ec7af069
SHA256

25375381dbcdeba66be938a2d93b464776508131d00775000f418c6322b071ed
SHA512

77719afa671b4fd3de800e06be9b5cdb50eaa18f4567fbbfd62539ffa9d167c0ed21b6410e5572a7310103cba254c3049f57fcff45f46c6e4479a3cb2038185e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	980	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\cp1006.pyc
1⤵
- Modifies registry class
PID:4824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1516

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
85665bb4274ee78857c4b5f7a7a4694f

SHA1
7910ed7c3da6d1a0756847d048e787e5172085d4

SHA256
7e377b35724014a0d9040a35437e94d90488475c478e08b70bc8dc598d171c3c

SHA512
4a0a5276c95a0c274d0b759e7e9dffed62742f773cc37675e56439b9a10d38678dfa21fa169d3492d2f0ef86471bd5d2192af93d6e41346c652a90e71efe1b3a

Download Submit
memory/980-40-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-42-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-33-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-34-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-35-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-36-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-37-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-38-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-39-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-43-0x000001ED45B30000-0x000001ED45B31000-memory.dmp

Filesize
4KB

Download
memory/980-32-0x000001ED45EE0000-0x000001ED45EE1000-memory.dmp

Filesize
4KB

Download
memory/980-41-0x000001ED45F00000-0x000001ED45F01000-memory.dmp

Filesize
4KB

Download
memory/980-0-0x000001ED3D840000-0x000001ED3D850000-memory.dmp

Filesize
64KB

Download
memory/980-44-0x000001ED45B20000-0x000001ED45B21000-memory.dmp

Filesize
4KB

Download
memory/980-46-0x000001ED45B30000-0x000001ED45B31000-memory.dmp

Filesize
4KB

Download
memory/980-49-0x000001ED45B20000-0x000001ED45B21000-memory.dmp

Filesize
4KB

Download
memory/980-52-0x000001ED45A60000-0x000001ED45A61000-memory.dmp

Filesize
4KB

Download
memory/980-16-0x000001ED3D940000-0x000001ED3D950000-memory.dmp

Filesize
64KB

Download
memory/980-64-0x000001ED45C60000-0x000001ED45C61000-memory.dmp

Filesize
4KB

Download
memory/980-66-0x000001ED45C70000-0x000001ED45C71000-memory.dmp

Filesize
4KB

Download
memory/980-67-0x000001ED45C70000-0x000001ED45C71000-memory.dmp

Filesize
4KB

Download
memory/980-68-0x000001ED45D80000-0x000001ED45D81000-memory.dmp

Filesize
4KB

Download