c7c9658716d69b50009eb23459c62fa6305a1102f01e197a04cc82fba333290a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fatalservices.rar
Size

2.8MB
MD5

ddebc77ef72c95f07d3dc0f0018e1c8e
SHA1

4ab642a7d73885f5702c1a10dfb20bf00c41c683
SHA256

c7c9658716d69b50009eb23459c62fa6305a1102f01e197a04cc82fba333290a
SHA512

92b97782d7dd45cbaa392bbcba97fde3370597d910fb2ac39feccaaa2e85db65c5118b9bc8c82d78b0944213565150491b708c7d4da4769a25af59d880d3bcd8
SSDEEP

49152:eYO6W/JsA0rUfVcFV3X5XB7JaGu2fkNyEoqSvJfQm4SG6qakPlQ39CvNZEFWjYPu:eYO6W/JH8UOFV3pBIX2fkQEeNQQG3Pms

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3120 OpenWith.exe

pid	process
3120	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fatalservices.rar
1⤵
- Modifies registry class
PID:3576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads