Analysis
-
max time kernel
151s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 06:33
General
-
Target
Resource/pca.admx
-
Size
9KB
-
MD5
0abfe09e86cbaf074c2a6efc603720eb
-
SHA1
9291fd7531e839342a0a010589e637b15d6c0ab6
-
SHA256
13a96dcba9cc049dbeeba890c8d4845cddf7d9307395ffc98f0c8a4faa0b9e71
-
SHA512
05132b9e0ffb36b9fd964a42878997953ebdb83d2357d5d9887992d4c5c445d4a4132d754f2820a336b48834c72b7c42af09be24e6be4e52db059464cf3dd074
-
SSDEEP
192:vYpu2Jx6X6jJLcVhkGLJVhwhLMVhcuufLKhcwryr4:AP6X6dLcVhvLJVhoLMVh4fLKhjryr4
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Resource\pca.admx1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx