0f931ef68b73d54c7badb15ce19ffe79a9ebb6489ecf86a808cd57b3874404d2

Analysis

max time kernel
51s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_locales/hi/messages.json
Size

49KB
MD5

08dca91638f7f5c5d39bd655aa884a0f
SHA1

98510acd8f9d02233c6dfc0bf9093df0eab76bd3
SHA256

a882aa7c0b3f2bf590d88265f7e95f208b42c4846b88d4dddb69608e04ab87d0
SHA512

373c2cc5491a222138b654cda413a0208dff3d99f1402a68172915c6cc9cda9ce9394ba441fa57b0911171584a3d818ac184487bcefcbc9e40ede561e3e5c0bd
SSDEEP

384:PkWfLtERFEgbf/Af+QKmR3kE4ggRSVrcemNTl15B/jtzGVYwcB1yXwAzlrOrrE7y:qFhippuDjJd3IuQnfqiAgBVvlx+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3856 OpenWith.exe

pid	process
3856	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_locales\hi\messages.json
1⤵
- Modifies registry class
PID:1048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3856

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads