f9e7d7ea90729122761d00d7e48945aa4e6094526c6fb551e6cc9f690ac2e671

Analysis

max time kernel
117s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

#!!SetUp_PassW0rd$$__11064.rar
Size

9.8MB
MD5

2f6f383688540af21e122f29798d47a4
SHA1

8a1c28403ff2e92acddac733d3658624a50bc3fe
SHA256

d179b193451aa412053f2b45f0b83023f897776d1d0c82665cdd9c86713bbc1b
SHA512

3086499c568379cd8857fa0b4e8da052cd8b831a2cc214b90e37ed20e602e0c6443dd2ada017c2f823db9302fcb3dcdd3a86c2aabf5b24d2e2971d7c1e794b04
SSDEEP

196608:7bK0ebPGxqKkM53ikFi70KXU1nkOOMXSq/SW39gje/avZC7:7aPi3kM53ikFq0mAnROMXb//3GCGk7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	OpenWith.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2188	OpenWith.exe
2188	OpenWith.exe
2188	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\#!!SetUp_PassW0rd$$__11064.rar
1⤵
- Modifies registry class
PID:2320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...