Resubmissions

21/05/2024, 00:50

240521-a7ax3sdb7s 4

21/05/2024, 00:49

240521-a6nsjsdb5s 1

Analysis

  • max time kernel
    1386s
  • max time network
    1173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 00:50

General

  • Target

    pagefile.7z

  • Size

    79.4MB

  • MD5

    ecda4d60df1dd5a867f94f75076103ea

  • SHA1

    e9e4c67cd80950f418e17ccecf699ba3e70b9201

  • SHA256

    b4b96e61980599af727294cc05e85675e789f872b5c42346096f422c118de084

  • SHA512

    f2f9f34158966a42e8ced2684c8febfb72973636d2e662fa4b80c2c2edec51cb0285e7a0f097fb38d8adbce2fb6b718d09a0ee015c5875d369783570a3d07133

  • SSDEEP

    1572864:3qzvGjsfKKocul6DRJMawJIjK6QD//fB4cGLlR8v7qFrohUxt:30vA8KKo36DMbF603fBzKm7qFP

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\pagefile.7z
    1⤵
    • Modifies registry class
    PID:2276
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads