0d8ea62f062e14bdded875879212a3162fd0c08737ba38332fdce0ef1eebcd83

Analysis

max time kernel
109s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R3Air.2.0.0.Release.64/R3Air.swf
Size

12.0MB
MD5

10049e4b660bb0814e2d929f17a99262
SHA1

e0d4f10d6fe1c12d48ababe4b8a6ac74576b91e5
SHA256

bd7ba2530b9fc1f16d2784aba9ea89ac7b1b3623ab68bd2d0009b151fcc85d85
SHA512

4cde7fcfb59bac137477643c959348999657f1514a7cd94346f49b81e80dc1213778c9d4bc139763200cf8258d0ce92f809c2a982b565ea265ceb97df48ae79d
SSDEEP

393216:5oHFpL0Cwpg4ydLrQ6ePC9/VhFpA0CRW6XQw48:8FFVwW4ydDIC91+0CRn48

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3508	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\R3Air.2.0.0.Release.64\R3Air.swf
1⤵
- Modifies registry class
PID:2628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4828 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads