ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
92s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/btn_keep.bmp
Size

140KB
MD5

cf724cd2543929b8dc4d0964c173b28f
SHA1

3ec6c531c77c2f9cdde1a3aa14f62b9735e4292f
SHA256

189907252b9a78182f95eacf983fdf5393d2c6c90b45ffd4d99092201612868f
SHA512

e3890f1e3b2b6299cd03ef1be84e47229ae4de57156c4b20d0b49dda8f2a28715c41754d9a4a3a3d3cc0f271345e6953322bbb7da8712775bc967a50fc1bfa7d
SSDEEP

3:yZl/sFlu6A1MLjLHn:Jfu6A1Mnbn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

484 OpenWith.exe

pid	process
484	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\btn_keep.bmp
1⤵
- Modifies registry class
PID:2332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads