Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25-05-2024 20:28
General
-
Target
Minitool powerdata recovery/X86/Business Deluxe/PowerDataRecovery.exe.mfh
-
Size
52B
-
MD5
caf189790d0262fec15a361ce7cfb6a9
-
SHA1
ec15d22598b3b24152a2842d9b2b9cac522a5433
-
SHA256
7f85511fdf70660e7f8d8e0fbd21cb0c7dec661a17fd9464d2ce59c1cf7c1425
-
SHA512
f24aab4a1486b385cf5bac1dd77125cf18ee9993e627197558b55b4b5b9302b96210bb486fb1c8ec2644235aa81845f4f8b1c88467f95e53329d8e0210b645d2
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Minitool powerdata recovery\X86\Business Deluxe\PowerDataRecovery.exe.mfh"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx