Analysis
-
max time kernel
136s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 21:41
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20240508-en
General
-
Target
main.pyc
-
Size
7KB
-
MD5
8d37f316447dbc4c9b2f5c3bd6ffc714
-
SHA1
60f082864e47a04771e608cb57d3f28840155430
-
SHA256
f99f867c0f5d238dc4adbc541c8d252303bf1e9843a932819d2bcdfe897f1811
-
SHA512
9706a3ebf826eb1f20aa828383486d8bf7e14736570bed783291dbb740ffe697570b66430a84dc0384ce71e7b6116dfaa34f2200751d8d4b8833f50d130cf234
-
SSDEEP
96:zTAjADtHozb9dS5be24D3VgANPEkUwNHnxTYCJK:IjsHozfCbe223VgANPDU2n6C4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 764 OpenWith.exe