Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

  • max time kernel
    1478s
  • max time network
    1499s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-04-2024 19:25

General

  • Target

    257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf

  • Size

    1.2MB

  • MD5

    a78380f647766a2bc099844375bd5a4c

  • SHA1

    4546876d037d899090260fcf9fe49683998cc9de

  • SHA256

    257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc

  • SHA512

    16f9c97b8f46f85ef003174b94ff5444d91845e759ae3fee3e7f468e22232c8afb0d068942eb8b73686caca299f3998bf0cb235a918ea81e3c2ddc15167f5c43

  • SSDEEP

    12288:EOAMgUW8jfDhKGCotRnmpi6pF4XhCZDicNFeDG/p1vaKfgUZmao:/I2j7hZCoPnmp3p7DbNcK7zw

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf
    1⤵
    • Modifies registry class
    PID:2980
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads