ab7e4085828b98e52db4a171a5c3b01f7e6a3c1ab97885466a5f97e35e6a10a1

Analysis

max time kernel
130s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/05/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

overrides/config/abnormals_delight-common.toml
Size

137B
MD5

aeda1340f06341acd26708218a89b960
SHA1

b46155451616f4a2311ae31d992453253e143537
SHA256

135425bd7d8259fe1a42a2fce422b0ad25946ca8ba8bb399dd03527b76ea484f
SHA512

e6045a81647300264f5c296dc1a6ccced7630575b586ef605d5d9d63c79dad92af4365b8622be5a956087fd4178af87beb5dc9c3dc8328c5c5c8af4a9fb2f4de

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
168	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\overrides\config\abnormals_delight-common.toml
1⤵
- Modifies registry class
PID:3484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...