24fe65718394b79c9d647247a56788d65b3027391ab9f09484705b1d57635818

Analysis

max time kernel
160s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011 Factory Drum.smp
Size

5.9MB
MD5

d9e4ad431608cf98383a6eae4eacccfc
SHA1

027e810908464624644b8d2cf8aa7e30a310f475
SHA256

fda31e31be1e999425778157c41f636b48532282b0c0734479aa68a3371e3395
SHA512

fce5d01d3b50cd88e1b1e566ae5923e51c7bc73196ae85328f49ec632a39cd6640a0481dfee0d84bcb8ce81a828eeb6153b05dd80ee62a0a978b9f6954ba0e23
SSDEEP

98304:FPNnxvMW6kdOvYWl+Q0A1e7Fph0Km2OXgsVGVLE1d5Zie5rYINwdw19lRutmEBXO:FPNRt6kMvNl30xh9vwRVyEb+eZYINp1l

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

416 OpenWith.exe

pid	process
416	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\011 Factory Drum.smp"
1⤵
- Modifies registry class
PID:5300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5124 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads