953592b85e8972a6496f4f6674b260829cda59c6876ca4a15d03d8440ecc62f6

Resubmissions

09-07-2024 02:17

240709-cqtpza1err 8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09-07-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trap-Stealer/builder.sh
Size

1KB
MD5

79939ec539077ebc6850a13bab7cb50e
SHA1

c8e87d0c26e55bbc844436b94ccc0e57a0a9711c
SHA256

b39077b1b116f8b7a5e6640031a12707f424f78bf6ac68fca5906b5197a4ec04
SHA512

9210d822346520668f47b6e2e0eff96aebbffc7e74a0701915b3c33433dbee8be0da19d1d78b52143f38a01f38738759b2768ff3e732d88d4cea2646a1e6f588

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3620 OpenWith.exe

pid	process
3620	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Trap-Stealer\builder.sh
1⤵
- Modifies registry class
PID:644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads