Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-06-2024 02:18

General

  • Target

    Tango Release.rar

  • Size

    39.6MB

  • MD5

    632ca437cdd3f0a06af0797d839e59de

  • SHA1

    d5579d2459f619958b039db479edc6b55a9a3f25

  • SHA256

    84e74424f9c3409c334e62f98d8325ad7f2c0e39fe7a17cc0aa2bf042d41c11e

  • SHA512

    84f3cb4776b05c6351d339359e689a33eaf9de2323d71cfa3462077e2a1f1675b206fe78ef085334ea8b08a55b25efc0d9e461fdbcd12070db60d19018b79d00

  • SSDEEP

    786432:/ynXMl6nhvoJVWcFJ3DKlL117O7VnuerVB7pq48D3R/UBzFbaxH+3Thk:yMl6hcFF+8VzrzkRcLaV+dk

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Tango Release.rar"
    1⤵
    • Modifies registry class
    PID:2200
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:744
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

    Filesize

    10KB

    MD5

    a05de6626e878c11872bcf9a152a692c

    SHA1

    8e2e338228d149511acd9740a84d5310c33f7f2c

    SHA256

    2b028061471208157f927bc0495bd6814ebce7edb5c6a0cf5f6d8d065845d704

    SHA512

    9f73b10f2acb9d22d8c02428f55759d55c4a6d8f4521f2c8f698c7d20280aded26a3e2ecd565507d5e8334ba4843076fbc42e3df74b49a8bc20eeb71d9ceb520