f58e17c0eab566b5816ab490d16d9b2bfcb128ece5bdd75b9bbf827f46160f3f

Analysis

max time kernel
91s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

is malware.apk
Size

9KB
MD5

78a1471a5922ba96608dddc2fb77f4eb
SHA1

fd069a46684ea7d0be68d9ac2b0c46cae27eb6ce
SHA256

f58e17c0eab566b5816ab490d16d9b2bfcb128ece5bdd75b9bbf827f46160f3f
SHA512

5f315f9384a5b3dd6ef9fad7ffb85b5bdbc4df94b54bfe41013bd91d2bf5db270a151671e936975f464e3cc9848578126bf709bc398cab33b937e77a918b2a29
SSDEEP

192:TLt7+5NV3AnhadZoPCg2S0yUE32WImcHEqSrIsdSAfG0j6GX3Zp2/+E:TLtuwwKNV0iI+qeIs3GU6GXJ2V

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

4220 OpenWith.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4220 OpenWith.exe

pid	process
4220	OpenWith.exe

pid	process
4220	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\is malware.apk"
1⤵
- Modifies registry class
PID:4880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads