208673224933c0afac03ed353d00261e836d96395eef6f4910770c5e471333ec

Analysis

max time kernel
1381s
max time network
1168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

encodings/aliases.pyc
Size

10KB
MD5

6ed637d8773035426243f1142c5c80bd
SHA1

c2df5a52606d14bd322fd12e8b1eea9b8e31d0af
SHA256

2706fe0ba3620d9d2cc342c94e02e06f196f1d16436d0f1091237d6d4bebf30f
SHA512

47cde7148ae33d0eef6a5b94b2265762fd3c62e29640ee6f45cc23a488e5872f600a311f68bde541b0383b5223a9480983cec57a6680fd59533902260f739f95
SSDEEP

192:GX2eNkBweGfGkueK4+I14Xqb36RhOgaxL8PZm+/Qnu1iXFzxOkq4bpehh3qkyR0N:GXG0bueBU6uHc+Izx9IX6Ri

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	916	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\aliases.pyc
1⤵
- Modifies registry class
PID:4568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
155c72199ff3874f9ada925b12f57cc0

SHA1
1b10032d37b35c5dca9f47884aad2c0881ac991d

SHA256
719e9dc94f20df732171de1d0d0b9873fa52299fbdb7ea06027d7b91f6dac80f

SHA512
981a72a1bc66c26abd57ade7239de61afcbe2c8ba2938d13167b095100ea1964f5cb7f90b2c68d31694f1c3ce1edf1c9ec8cce1ef58d26bafd62678546da3583

Download Submit
memory/916-36-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-37-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-33-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-34-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-35-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-0-0x000001A3D2E70000-0x000001A3D2E80000-memory.dmp

Filesize
64KB

Download
memory/916-42-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-38-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-39-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-40-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-32-0x000001A3DB560000-0x000001A3DB561000-memory.dmp

Filesize
4KB

Download
memory/916-41-0x000001A3DB590000-0x000001A3DB591000-memory.dmp

Filesize
4KB

Download
memory/916-52-0x000001A3DB0E0000-0x000001A3DB0E1000-memory.dmp

Filesize
4KB

Download
memory/916-44-0x000001A3DB1A0000-0x000001A3DB1A1000-memory.dmp

Filesize
4KB

Download
memory/916-46-0x000001A3DB1B0000-0x000001A3DB1B1000-memory.dmp

Filesize
4KB

Download
memory/916-49-0x000001A3DB1A0000-0x000001A3DB1A1000-memory.dmp

Filesize
4KB

Download
memory/916-43-0x000001A3DB1B0000-0x000001A3DB1B1000-memory.dmp

Filesize
4KB

Download
memory/916-16-0x000001A3D2F70000-0x000001A3D2F80000-memory.dmp

Filesize
64KB

Download
memory/916-64-0x000001A3DB2E0000-0x000001A3DB2E1000-memory.dmp

Filesize
4KB

Download
memory/916-66-0x000001A3DB2F0000-0x000001A3DB2F1000-memory.dmp

Filesize
4KB

Download
memory/916-67-0x000001A3DB2F0000-0x000001A3DB2F1000-memory.dmp

Filesize
4KB

Download
memory/916-68-0x000001A3DB400000-0x000001A3DB401000-memory.dmp

Filesize
4KB

Download
memory/916-69-0x000001A3DB300000-0x000001A3DB301000-memory.dmp

Filesize
4KB

Download
memory/916-70-0x000001A3DB2F0000-0x000001A3DB2F1000-memory.dmp

Filesize
4KB

Download