bab8b5e74ab7210b030316dd5685f3fdcceac35bd3b3a90e5dd01592f8abb630

Analysis

max time kernel
130s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-06-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NursultanNextgen2024/assets.rar
Size

4.9MB
MD5

18e6e3b39e78a2cdc999a10503ee6c3d
SHA1

2dcb7265e54a33cc1bbd6b08914712120e7e0723
SHA256

888dabbf512949d7e0d2c5ad7143b02cdabc16d314f7a3ef2db0eb88843caadb
SHA512

38049928c7935e00a03f85054b4887d641d087cd43264680573399b0f658b057b07ad3c3f48a7361ad8ff2abeb0694cb03b97fcfe9cb0cbcf257f097940ed230
SSDEEP

12288:XpaCOXfw0Nf5xF1XzotVVr6RaRaYaOa3aZamaFa4aLnBuNkQib:52fw03xFR02S7H68Hwl2j

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3768 OpenWith.exe

pid	process
3768	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\assets.rar
1⤵
- Modifies registry class
PID:2256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads