ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
150s
max time network
166s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/select_bg.bmp
Size

59KB
MD5

ff051f124f5d85f23efd007c9ae2e465
SHA1

c6f0adbf30888e8ba5a6ade5dfb3d43e773f9a75
SHA256

4b1f2c35e4f53778cee78a84c64d0a44e3bf5c1a751ff8a66d16c47bb7e082eb
SHA512

523c864ec9eb6a289c65e5160b6eae3437500b950865398e841c05378a2497c5c7db31187e01b7295b12a49c47c18809908d5ceb55f5ba3043d81577c3b358f8
SSDEEP

6:5A/6BTZaRah8km8WpS4zo3BaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaa4:5Ai3y8Wg4zoX4zoC8WMa0d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

476 OpenWith.exe

pid	process
476	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\select_bg.bmp
1⤵
- Modifies registry class
PID:2516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads