7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213 | Triage

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 19:03

Sharing

Report Analysis Logs

General

Target

CAD迷你画图/DWGDrawRun.exe
Size

59KB
MD5

b05f1ea54a62abb2956b8ad1cc7a59ed
SHA1

5456816d5baf0fe7cd2d16bfac6e6527f9097e7e
SHA256

b8fdf1e9035c4e322946ba2b6a0e94df95844c442c663956730a23b50ea0308c
SHA512

f99efce73e269d825c0e95ccb27a621d047f897fae7f52933274948ad9b3e173e96740f1cdccfd44885dca4be09eba6139208d2ce34c75dfd3726549e1285515
SSDEEP

1536:IF5/ETpNvAFPby+IkmMbPf65ftwdY3hhQd:2E9Kcuz65ftwdKQd

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

Processes:

DWGDrawRun.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwg\ = "dwgFile"	DWGDrawRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile	DWGDrawRun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\ = "DWGÍ¼Ö½"	DWGDrawRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\DefaultIcon	DWGDrawRun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CAD????\\dwg.ico"	DWGDrawRun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CAD????\\DWGDraw.exe \"%1\""	DWGDrawRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dwg	DWGDrawRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\Shell	DWGDrawRun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\Shell\ = "Open"	DWGDrawRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\Shell\Open\Command	DWGDrawRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwgFile\Shell\Open	DWGDrawRun.exe

C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\DWGDrawRun.exe
"C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\DWGDrawRun.exe"
1⤵
- Modifies registry class
PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads