Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 03:02

General

  • Target

    CommandPost.exe

  • Size

    7.9MB

  • MD5

    cb97105462eb022605c2b6d434c30aba

  • SHA1

    c3b2e2b94aecfda319b5b97d92580d20abdafe58

  • SHA256

    f27af6504285706f0a32470955a45c9b6f6f860cd73580b7074aa2277d033388

  • SHA512

    74b0959ca537d780ded779a45f4ed5198f563d63fa742badfd05f7a03caf9271cb6649ccbd6a16eee92bfd2026629e9d4658680bd1fe150df86f6de506df6eb9

  • SSDEEP

    196608:u5BKd5QJ+ENE7qXlfvpkSIR5sTyC6M/+3rb:u/KwtJvpkS/yC8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 35 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CommandPost.exe
    "C:\Users\Admin\AppData\Local\Temp\CommandPost.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    28KB

    MD5

    e079fdbcc216413c3b000f0e5bd61f14

    SHA1

    a871c86fe6c0af93ab813daf4cd4d7bdc7a38c3c

    SHA256

    166171f3731fe41f78730532f6618b4daf736ffa8100541d11115e034c8f8fff

    SHA512

    5501f441b973fd57bdc4a5eb62f69faa90b793c3f61b66039cafa811702820c19bcb7cd21498f04fc87aa07746a673cf0985931f0629e38d6761c7841b2ff549

  • memory/3184-6-0x00000220F4F50000-0x00000220F5002000-memory.dmp

    Filesize

    712KB

  • memory/3184-2-0x00000220F3520000-0x00000220F3530000-memory.dmp

    Filesize

    64KB

  • memory/3184-3-0x00000220F1340000-0x00000220F1350000-memory.dmp

    Filesize

    64KB

  • memory/3184-4-0x00000220F1350000-0x00000220F1360000-memory.dmp

    Filesize

    64KB

  • memory/3184-5-0x00000220F4DB0000-0x00000220F4E5C000-memory.dmp

    Filesize

    688KB

  • memory/3184-0-0x00000220F07A0000-0x00000220F0F86000-memory.dmp

    Filesize

    7.9MB

  • memory/3184-7-0x00000220F5040000-0x00000220F5062000-memory.dmp

    Filesize

    136KB

  • memory/3184-9-0x00000220F5070000-0x00000220F507A000-memory.dmp

    Filesize

    40KB

  • memory/3184-10-0x00000220F3520000-0x00000220F3530000-memory.dmp

    Filesize

    64KB

  • memory/3184-15-0x00007FFA83D80000-0x00007FFA84841000-memory.dmp

    Filesize

    10.8MB

  • memory/3184-16-0x00000220F3520000-0x00000220F3530000-memory.dmp

    Filesize

    64KB

  • memory/3184-17-0x00000220F3520000-0x00000220F3530000-memory.dmp

    Filesize

    64KB

  • memory/3184-1-0x00007FFA83D80000-0x00007FFA84841000-memory.dmp

    Filesize

    10.8MB