Resubmissions

11-06-2024 05:26

240611-f48ylawcpf 1

11-06-2024 05:26

240611-f4v2qswgqm 3

Analysis

  • max time kernel
    10s
  • max time network
    14s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11-06-2024 05:26

Errors

Reason
Machine shutdown

General

  • Target

    Screenshot_2.png

  • Size

    1.5MB

  • MD5

    10762190cb07aa402a52956c366bfc12

  • SHA1

    7fa47f86156b4e37a27fdec992bf4cb5367932d3

  • SHA256

    7a02a9616d7fc81b412a46e036c7e562e9b86a9912a0b9202ba429da6aa774ec

  • SHA512

    001489d6661b958832ff5dd7e7752efeb554c9e998952db972a325cbfb133f2887b5aff1e19767d30a94d1f80e678a9240cd39fbd5bd60ed39cc79ec0bc1a519

  • SSDEEP

    49152:hv2EqE+fN7wVw8dBq85JIsWWvPh2q/MM/WwewrBC:hxnAwG8dxw3G+8w

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Screenshot_2.png
    1⤵
      PID:3304
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3740
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3a09055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:5068

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads