Analysis Overview
SHA256
5763f5a4cdeae5f7b7a58fe0b43c78b2cfb7dd9cf5dd0e81d58dd832d3a28ec7
Threat Level: Shows suspicious behavior
The file Gooat___Proxyless.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Detects Pyinstaller
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-25 21:41
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-25 21:41
Reported
2024-05-25 21:46
Platform
win11-20240426-en
Max time kernel
205s
Max time network
275s
Command Line
Signatures
Loads dropped DLL
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe
"C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe"
C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe
"C:\Users\Admin\AppData\Local\Temp\Gooat___Proxyless.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushTest.MTS"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | artisan.cointelegraph.com | udp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| US | 104.18.198.52:443 | artisan.cointelegraph.com | tcp |
| GB | 2.18.66.65:443 | tcp | |
| US | 20.189.173.26:443 | browser.pipe.aria.microsoft.com | tcp |
| NL | 23.62.61.194:443 | r.bing.com | tcp |
| NL | 23.62.61.194:443 | r.bing.com | tcp |
| NL | 23.62.61.194:443 | r.bing.com | tcp |
| NL | 23.62.61.194:443 | r.bing.com | tcp |
| NL | 23.62.61.194:443 | r.bing.com | tcp |
| NL | 23.62.61.194:443 | r.bing.com | tcp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI50242\python310.dll
| MD5 | 63a1fa9259a35eaeac04174cecb90048 |
| SHA1 | 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a |
| SHA256 | 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed |
| SHA512 | 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\VCRUNTIME140.dll
| MD5 | f34eb034aa4a9735218686590cba2e8b |
| SHA1 | 2bc20acdcb201676b77a66fa7ec6b53fa2644713 |
| SHA256 | 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1 |
| SHA512 | d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\base_library.zip
| MD5 | 866832ed5917cf86a813066281bf0214 |
| SHA1 | 9fb6b981d418d36b12c3f1ea16606f5e0badb9f7 |
| SHA256 | 64996668360584314d84d7e4fcd89549715741572e14f6c63e59be0a40f44647 |
| SHA512 | 80ee6c3fd857b959e5c6a4f9f77b5af19394402dad0c6909100a7d711fd4df76a4b6c6eaa5ae0380193cb9702a4dc53e01524ce797b278eef848a6a97e83bb11 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\python3.DLL
| MD5 | fd4a39e7c1f7f07cf635145a2af0dc3a |
| SHA1 | 05292ba14acc978bb195818499a294028ab644bd |
| SHA256 | dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9 |
| SHA512 | 37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ctypes.pyd
| MD5 | 1635a0c5a72df5ae64072cbb0065aebe |
| SHA1 | c975865208b3369e71e3464bbcc87b65718b2b1f |
| SHA256 | 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177 |
| SHA512 | 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_socket.pyd
| MD5 | 819166054fec07efcd1062f13c2147ee |
| SHA1 | 93868ebcd6e013fda9cd96d8065a1d70a66a2a26 |
| SHA256 | e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f |
| SHA512 | da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\select.pyd
| MD5 | a653f35d05d2f6debc5d34daddd3dfa1 |
| SHA1 | 1a2ceec28ea44388f412420425665c3781af2435 |
| SHA256 | db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9 |
| SHA512 | 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libcrypto-1_1.dll
| MD5 | 9d7a0c99256c50afd5b0560ba2548930 |
| SHA1 | 76bd9f13597a46f5283aa35c30b53c21976d0824 |
| SHA256 | 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939 |
| SHA512 | cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ssl.pyd
| MD5 | 7910fb2af40e81bee211182cffec0a06 |
| SHA1 | 251482ed44840b3c75426dd8e3280059d2ca06c6 |
| SHA256 | d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f |
| SHA512 | bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libssl-1_1.dll
| MD5 | bec0f86f9da765e2a02c9237259a7898 |
| SHA1 | 3caa604c3fff88e71f489977e4293a488fb5671c |
| SHA256 | d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd |
| SHA512 | ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_brotli.cp310-win_amd64.pyd
| MD5 | 6d44fd95c62c6415999ebc01af40574b |
| SHA1 | a5aee5e107d883d1490257c9702913c12b49b22a |
| SHA256 | 58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a |
| SHA512 | 59b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\MSVCP140.dll
| MD5 | 1ba6d1cf0508775096f9e121a24e5863 |
| SHA1 | df552810d779476610da3c8b956cc921ed6c91ae |
| SHA256 | 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823 |
| SHA512 | 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_hashlib.pyd
| MD5 | d4674750c732f0db4c4dd6a83a9124fe |
| SHA1 | fd8d76817abc847bb8359a7c268acada9d26bfd5 |
| SHA256 | caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9 |
| SHA512 | 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\VCRUNTIME140_1.dll
| MD5 | 135359d350f72ad4bf716b764d39e749 |
| SHA1 | 2e59d9bbcce356f0fece56c9c4917a5cacec63d7 |
| SHA256 | 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32 |
| SHA512 | cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_queue.pyd
| MD5 | d8c1b81bbc125b6ad1f48a172181336e |
| SHA1 | 3ff1d8dcec04ce16e97e12263b9233fbf982340c |
| SHA256 | 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14 |
| SHA512 | ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_bz2.pyd
| MD5 | 86d1b2a9070cd7d52124126a357ff067 |
| SHA1 | 18e30446fe51ced706f62c3544a8c8fdc08de503 |
| SHA256 | 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e |
| SHA512 | 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535 |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_lzma.pyd
| MD5 | 7447efd8d71e8a1929be0fac722b42dc |
| SHA1 | 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6 |
| SHA256 | 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be |
| SHA512 | c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\unicodedata.pyd
| MD5 | 81d62ad36cbddb4e57a91018f3c0816e |
| SHA1 | fe4a4fc35df240b50db22b35824e4826059a807b |
| SHA256 | 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e |
| SHA512 | 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d |
C:\Users\Admin\AppData\Local\Temp\_MEI50242\certifi\cacert.pem
| MD5 | ea4ee2af66c4c57b8a275867e9dc07cd |
| SHA1 | d904976736e6db3c69c304e96172234078242331 |
| SHA256 | fa883829ebb8cd2a602f9b21c1f85de24cf47949d520bceb1828b4cd1cb6906c |
| SHA512 | 4114105f63e72b54e506d06168b102a9130263576200fb21532140c0e9936149259879ac30a8b78f15ae7cb0b59b043db5154091312da731ac16e67e6314c412 |
memory/2128-85-0x00007FFE9D840000-0x00007FFE9D874000-memory.dmp
memory/2128-84-0x00007FF699EB0000-0x00007FF699FA8000-memory.dmp
memory/2128-86-0x00007FFE8BAE0000-0x00007FFE8BD96000-memory.dmp
memory/2128-87-0x00007FFE8A5F0000-0x00007FFE8B6A0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-25 21:41
Reported
2024-05-25 21:46
Platform
win11-20240426-en
Max time kernel
90s
Max time network
201s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding