Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
10-07-2024 21:08
General
-
Target
MARD_25_2/atwtusb.exe
-
Size
600KB
-
MD5
ad9dd508d210487f099ab56fe2ea40d6
-
SHA1
031e2c1d484c8c215f48f851df8cda2ac2e7dd96
-
SHA256
46c05479987097e5d4a4a128db1011182bdd9ed339ef97ef6a99bd973bc5738f
-
SHA512
58905b72ec63bbd8ce6f7623b16a17e91c4be53357bebe2dbefbf2cf2165ef555848916039db00160e4537e3ee8820a590ac0c845ad89ee9921321ebb8488f92
-
SSDEEP
12288:lJeJfEuGstgg/kjp98zHpie5nsaIQVbOIi7ulr:lJeJfAqkjp98zHpieds+bXp
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MARD_25_2\atwtusb.exe"C:\Users\Admin\AppData\Local\Temp\MARD_25_2\atwtusb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MARD_25_2\Point32.exePoint32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage