Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 09:24
Static task
static1
Behavioral task
behavioral1
Sample
1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
Resource
win10v2004-20240508-en
General
-
Target
1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
-
Size
242KB
-
MD5
541f52e24fe1ef9f8e12377a6ccae0c0
-
SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6
-
SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
-
SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
-
SSDEEP
3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3956 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx1⤵
- Modifies registry class
PID:1824
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3956