ab66ae9108ab3ef95667ab1cc8ba055e8f2e3a0e04424142d82ef79442884c74

Analysis

max time kernel
44s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

radvideo32.exe
Size

231KB
MD5

2a1f547044b51927488a810ccd65cc55
SHA1

75bdb847ab03672027b0e82eb5cc697e41b274f9
SHA256

9366f072ae7efc7c40c2eea8621edae036473060a095ba6f87d58d4e01386862
SHA512

ed8501df0e6216bd4499284498d4dd96f5d7927e65114e9c8c4cb0521f7034a5c0e0ad5fbb28cbcef36c9a1d8bb3e54814cebdf09c28c41f4d102d13c1ea6e62
SSDEEP

3072:kouCTCxi+No+FykzqfmZ5YsGkfbRvo2cD4QhOCBN5dUs71hefbERgrx+BKszpaXI:tuCTCxbQ9N5hWfi5+03Oa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	radvideo32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	radvideo32.exe
Key created	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	radvideo32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	radvideo32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	radvideo32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	radvideo32.exe

C:\Users\Admin\AppData\Local\Temp\radvideo32.exe
"C:\Users\Admin\AppData\Local\Temp\radvideo32.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads