Analysis

  • max time kernel
    0s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06-06-2024 07:51

General

  • Target

    NLChecker.pyc

  • Size

    14KB

  • MD5

    93637bd176c597ba191aaee8f2825478

  • SHA1

    30f50e9753f9465c354896476b0a11c4f6fc3799

  • SHA256

    6d54497e65d5840d1c00ec973965f6075c71a3db6936338a1cc94cc6ec16ec01

  • SHA512

    b4cf2b8e53c74b8fb823c2dac15bea4ecb6823929cc2b9ea2d2c574911b62c190736d69cefd2d6e56cdc7e88b6115f7d6583d9dbdd8d9820450d608dc1bf0935

  • SSDEEP

    384:ahz8hCCu3cbNytQStKdbUmKLglPxNeXCqGo:Wz8YCe8ktQStKdbUmKaP2SXo

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\NLChecker.pyc
    1⤵
    • Modifies registry class
    PID:2500
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads