4887920ef09966bfd09a3930b12912f64c22d52eb9c11f228581de1aab9e5dae

Resubmissions

07/07/2024, 11:29

240707-nlxrlstcmd10

07/07/2024, 11:29

240707-nlmlms1cjq3

Analysis

max time kernel
91s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240704-de
resource tags

arch:x64arch:x86image:win10v2004-20240704-delocale:de-deos:windows10-2004-x64systemwindows
submitted
07/07/2024, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v8_context_snapshot.bin
Size 643KB
Sample240707-nlxrlstcmd
SHA256 38bd3610023c1f6bae1452096bdc3298a90baea4438afa08a74584aa75f997f1
MD5 bbc5480d9f231e5d0564edbb2a53284c
SHA1 87a6ea5db959ed7b038cc6edb2676263576490de
SHA512 d75aaa676710b1629c3e99cd60e185e5bc67e8d9f65d3f875daa88b7fc229c430fa52d02d799a703488375be39c7ea268170e5bd21cd9ccfbc8dcd86234e6168
SSDEEP 6144:gPm2hiHvnyB2vD5zwqIH2jjHnL3GWaa/rTKaU8STvx/scy7syEI92WkPZ2Ak:KkHPdvLHjGWaarO3/rasg2lPk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\v8_context_snapshot.bin
1⤵
- Modifies registry class
PID:1700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads