Analysis

  • max time kernel
    87s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-06-2024 14:27

General

  • Target

    Kiwi X/Monaco/globalv.txt

  • Size

    161B

  • MD5

    5cf9f238d4e62c8bcde351651c3a2a45

  • SHA1

    16f25e5686f1235d1fbd9b9954236b043d2e6260

  • SHA256

    eeb98f2c9911ae8ddd25f1b3be3732000f16788bda60aa962e9f8452012b1062

  • SHA512

    b2fb24e6309303220eead8ac60d68959d189178db62611361440cafd219b45e57d3b79656b51df13eb825097557e9cd735ef228c1fc82e593368ce30fb88ca58

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Monaco\globalv.txt"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Kiwi X\Monaco\globalv.txt
      2⤵
        PID:3756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads