6ab29183111ccec00711075daaa18673279d998916456e16507073526e1e8be7 | Triage

Analysis

max time kernel
110s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:14

Sharing

Report Analysis Logs

General

Target

90366255.wmf
Size

98B
MD5

36a768d4b7d523b07b9eab23a3eb5962
SHA1

9f4d04e95430b4985923ad1d848034749c446898
SHA256

6ab29183111ccec00711075daaa18673279d998916456e16507073526e1e8be7
SHA512

6aae5956599a0d4e4dbba483641f6f448272f4f2d66d901b829a9a0cc18e6daf2c70c3e31a0ab829756c906827b0351bcc38a6e3188f02620e3e3fd1fb959e7a

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	mspaint.exe
3152	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3152	mspaint.exe
3152	mspaint.exe
3152	mspaint.exe
3152	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\90366255.wmf"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads