Analysis

  • max time kernel
    49s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 19:51

General

  • Target

    AKUMA/__pycache__/mail.cpython-311.pyc

  • Size

    4KB

  • MD5

    2ae2232b74aac1c2d7b6ae09f2f3e21b

  • SHA1

    8f3c6d66830596b90bdd94e8b7b801ff0e182781

  • SHA256

    d23659a363b15b0bad585d59a6a32bf2ef0cc698fafb895f55ce661621ffa175

  • SHA512

    27b0db269e9e20d7e3c5f32e685b7b0b47b86650dc047029690f21509fa5ee63e0d440470355dd2130f250932113ca60c536ff9a2c2dddfbf35323c79c9b2b21

  • SSDEEP

    96:Biz21Hg5pr9ECtTAtzb71vKoliNiiiiiHiijTBvb7hjBDjU1ZG:Biz2Ih9pMzFKo1T5b7l61Q

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\mail.cpython-311.pyc
    1⤵
    • Modifies registry class
    PID:4896
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads