Overview
overview
10Static
static
3Order 0003...34.exe
windows7-x64
10Order 0003...34.exe
windows10-2004-x64
10Order 0003...34.exe
windows11-21h2-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3Granske.app
windows7-x64
3Granske.app
windows10-2004-x64
3Granske.app
windows11-21h2-x64
3Ligydidae.mam
windows7-x64
1Ligydidae.mam
windows10-2004-x64
3Ligydidae.mam
windows11-21h2-x64
3Marxs.ano
windows7-x64
3Marxs.ano
windows10-2004-x64
3Marxs.ano
windows11-21h2-x64
3exothecium.txt
windows7-x64
1exothecium.txt
windows10-2004-x64
1exothecium.txt
windows11-21h2-x64
3laantagningen.sav
windows7-x64
3laantagningen.sav
windows10-2004-x64
3laantagningen.sav
windows11-21h2-x64
3Analysis
- max time kernel
91s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
Order 00039940002334.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Order 00039940002334.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Order 00039940002334.exe
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Granske.app
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
Granske.app
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Granske.app
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
Ligydidae.mam
Resource
win7-20240508-en
Behavioral task
behavioral11
Sample
Ligydidae.mam
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
Ligydidae.mam
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Marxs.ano
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
Marxs.ano
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Marxs.ano
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
exothecium.txt
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
exothecium.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
exothecium.txt
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
laantagningen.sav
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
laantagningen.sav
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
laantagningen.sav
Resource
win11-20240419-en
General
- Target Granske.app
- Size 172KB
- Sample240610-ld2pgsfg76
- SHA256 4714b51a71661da35eea60d116ad8f19e7cf8055208d56f6c1b1854c38b8e4fb
- MD5 5b3e6e7c3929c14e4cb08ae96d1d2d4e
- SHA1 517ddba7fa02d373204bac62001c7a6822edee38
- SHA512 f1f5c746965c8f06406b0b6224cf4661db6ae68e7d6c33e9bbfbe5264c4a21a5702f80fad2c8003f275ab77041be31090dfa3b4d4bd54b7ad4247d4df772745d
- SSDEEP 3072:aZ/peI3AA1QvQEl2IKD9f/EhulOLPCU8Z5vBPDSifneI45GY9:aZRj1QNU1MuELPCZrPm6e/YC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 456 OpenWith.exe