0f931ef68b73d54c7badb15ce19ffe79a9ebb6489ecf86a808cd57b3874404d2

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_locales/el/messages.json
Size

54KB
MD5

8a28c0906de7c1ef50e723c31a0e0305
SHA1

19156e4de35ce5ddc7c69f12157cab55df93c714
SHA256

bbcdcfe9a64c770ec280f074c4cf03551761081347d57499058458f707af0f1b
SHA512

48065d120a163d9cc3d67a5e22c60b9807ce7b828e8e0585126d1fa66e904f02733f883c080efc3170f618db65146ea3c851200e7ac16ea5d0aac12a98912818
SSDEEP

1536:J/Cx23WZdsF1rOBpS4FyjmAEYhnvkCCyvrp6imbhLaEOUtJ+:J6ZNmnxlqt7+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3608 OpenWith.exe

pid	process
3608	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_locales\el\messages.json
1⤵
- Modifies registry class
PID:2208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads