Overview
overview
10Static
static
320230970 -...24.zip
windows7-x64
120230970 -...24.zip
windows10-2004-x64
120230970 -...24.exe
windows7-x64
1020230970 -...24.exe
windows10-2004-x64
3Begavelsen...ts.tnd
windows7-x64
3Begavelsen...ts.tnd
windows10-2004-x64
3Begavelsen...et.txt
windows7-x64
1Begavelsen...et.txt
windows10-2004-x64
1Begavelsen...lp.sca
windows7-x64
3Begavelsen...lp.sca
windows10-2004-x64
3Tubulident...es.ps1
windows7-x64
8Tubulident...es.ps1
windows10-2004-x64
8Tubulident...ge.hom
windows7-x64
3Tubulident...ge.hom
windows10-2004-x64
3Analysis
-
max time kernel
300s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
20230970 - SF PARQUET SERVICE 25.04.2024.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20230970 - SF PARQUET SERVICE 25.04.2024.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
20230970 - SF PARQUET SERVICE 25.04.2024.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
20230970 - SF PARQUET SERVICE 25.04.2024.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Begavelsens/befolkningstallets.tnd
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Begavelsens/befolkningstallets.tnd
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Begavelsens/lerret.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Begavelsens/lerret.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Begavelsens/underholdshjlp.sca
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Begavelsens/underholdshjlp.sca
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
Tubulidentate/Overbakes.ps1
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Tubulidentate/Overbakes.ps1
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Tubulidentate/Paaviselige.hom
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Tubulidentate/Paaviselige.hom
Resource
win10v2004-20240412-en
General
-
Target
Begavelsens/befolkningstallets.tnd
-
Size
2KB
-
MD5
c2d8cab2df0c5184a51cad4f321a64cc
-
SHA1
2068ec7cbee9bb22651b84cdfdb5258b62ea95ee
-
SHA256
21dfa4eabff3ca8cf50f2ad48ab42eb1616b76dcbcdae86705a4ffc204a36258
-
SHA512
0d521df41c6c415faa84244f153cfd653574356f21ae55a9cdbc24b7a8825454a661483a1405bb3ae71f067c7bfe7d1a4e729afc23a5346c36a524329a28d37b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2376 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Begavelsens\befolkningstallets.tnd1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx