6995e33cf3c6078ad21fa9f5dccb03cc8a12a27953768cf85ecab1ddce1852a7

Resubmissions

03/05/2024, 20:03

240503-ysqa8aeb6z 10

Analysis

max time kernel
1756s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

depot_228990/MFGW.app/Contents/Resources/lib/python3.9/concurrent/futures/_base.pyc
Size

21KB
MD5

d9ced7b8f7bb7a9500923727360d86db
SHA1

65eb1fd5420629f0cd1a3014cc43572fc5a42903
SHA256

edc10cba69b1c6424ec745fe6bd35c2006e36fc5e5d2b4c8d14d8c4fc3c66565
SHA512

a45bbc5e52d04c95c5d40413958338e8d870b59cde6fd9ba975771417db5e5ec60c465b7d59a5ce095b71e390bfceae9e21e1c07984ab7d580baeac9b915b370
SSDEEP

384:qtTOZGBf2bk6bFW5sBssFfctUz2YKGBRx7VpcFHYXPeL+vJQArxJsFA1fX8n:qtTOZGBObk6FfUUSYKGBRPp6GJQArxJg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\depot_228990\MFGW.app\Contents\Resources\lib\python3.9\concurrent\futures\_base.pyc
1⤵
- Modifies registry class
PID:5060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads