a8f5d94d129a152945380be776cd2004a1bda15347c2d73cf6b54dd436bf3de5

Resubmissions

07/06/2024, 15:08

240607-sh37faab9z3

07/06/2024, 14:59

240607-sc54vaab2t7

Analysis

max time kernel
134s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader-o.pyc
Size 87KB
Sample240607-sc54vaab2t
SHA256 e21a34b3f70341f56cff842d0b513b653dba9850719d194b995ea1e5793676a6
MD5 f844549e71269b58564f46952cf73729
SHA1 531a10da2a2dba4200960f1eae670a9cb282716c
SHA512 f73298801aedc60890fab6495e84443cf6bdcf4d7aed40361f4f877042092afc06cc3ecd2682346e1f36da9b053b1d496394c87641690730dc240f0d7d38deb4
SSDEEP 1536:Jx2R2NZFhD+dae0TNumSTOTR10T8khlk/hQG3vL:DpDK2NMCTz0TN4/hQKL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5012	OpenWith.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe
5012	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3836	5012	OpenWith.exe	76
PID 5012 wrote to memory of 3836	5012	OpenWith.exe	76

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc
1⤵
- Modifies registry class
PID:4904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\loader-o.pyc
  2⤵
  PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads