Overview
overview
3Static
static
1MalwareDat...er.zip
windows7-x64
1MalwareDat...er.zip
windows10-2004-x64
1MalwareDat...na.zip
windows7-x64
1MalwareDat...na.zip
windows10-2004-x64
1MalwareDat...pe.zip
windows7-x64
1MalwareDat...pe.zip
windows10-2004-x64
1MalwareDat...DME.md
windows7-x64
3MalwareDat...DME.md
windows10-2004-x64
3MalwareDat...dom.py
windows7-x64
3MalwareDat...dom.py
windows10-2004-x64
3MalwareDat...om.zip
windows7-x64
1MalwareDat...om.zip
windows10-2004-x64
1MalwareDat...pe.zip
windows7-x64
1MalwareDat...pe.zip
windows10-2004-x64
1MalwareDat...a2.zip
windows7-x64
1MalwareDat...a2.zip
windows10-2004-x64
1MalwareDat...ow.zip
windows7-x64
1MalwareDat...ow.zip
windows10-2004-x64
1MalwareDat...ow.zip
windows7-x64
1MalwareDat...ow.zip
windows10-2004-x64
1MalwareDat...ng.zip
windows7-x64
1MalwareDat...ng.zip
windows10-2004-x64
1MalwareDat...er.zip
windows7-x64
1MalwareDat...er.zip
windows10-2004-x64
1MalwareDat...rt.zip
windows7-x64
1MalwareDat...rt.zip
windows10-2004-x64
1MalwareDat...-1.zip
windows7-x64
1MalwareDat...-1.zip
windows10-2004-x64
1MalwareDat...ty.zip
windows7-x64
1MalwareDat...ty.zip
windows10-2004-x64
1MalwareDat...rt.zip
windows7-x64
1MalwareDat...rt.zip
windows10-2004-x64
1Analysis
-
max time kernel
90s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
MalwareDatabase-master.zip
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MalwareDatabase-master.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
MalwareDatabase-master/Ana.zip
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
MalwareDatabase-master/Ana.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
MalwareDatabase-master/NoEscape.zip
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
MalwareDatabase-master/NoEscape.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
MalwareDatabase-master/README.md
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
MalwareDatabase-master/README.md
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
MalwareDatabase-master/ddom.py
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
MalwareDatabase-master/ddom.py
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
MalwareDatabase-master/enderware/Deskbottom.zip
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
MalwareDatabase-master/enderware/Deskbottom.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
MalwareDatabase-master/enderware/Evascape.zip
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
MalwareDatabase-master/enderware/Evascape.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
MalwareDatabase-master/enderware/Koteyka2.zip
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
MalwareDatabase-master/enderware/Koteyka2.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
MalwareDatabase-master/enderware/ProgramOverflow.zip
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
MalwareDatabase-master/enderware/ProgramOverflow.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
MalwareDatabase-master/enderware/UserOverflow.zip
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
MalwareDatabase-master/enderware/UserOverflow.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
MalwareDatabase-master/fakescanners/Activation Security Warning.zip
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
MalwareDatabase-master/fakescanners/Activation Security Warning.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
MalwareDatabase-master/fakescanners/AdAvenger.zip
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
MalwareDatabase-master/fakescanners/AdAvenger.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
MalwareDatabase-master/fakescanners/Apple Alert.zip
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
MalwareDatabase-master/fakescanners/Apple Alert.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
MalwareDatabase-master/fakescanners/Apple System Security-1.zip
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
MalwareDatabase-master/fakescanners/Apple System Security-1.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
MalwareDatabase-master/fakescanners/Apple System Security.zip
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
MalwareDatabase-master/fakescanners/Apple System Security.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
MalwareDatabase-master/fakescanners/Apple-iOS Alert.zip
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
MalwareDatabase-master/fakescanners/Apple-iOS Alert.zip
Resource
win10v2004-20240709-en
General
-
Target
MalwareDatabase-master/README.md
-
Size
3KB
-
MD5
2f0c9dd2a112bf13385a1f57bd284d39
-
SHA1
83de7791dd6d930cd698edfd7c04f799148c4241
-
SHA256
cfcb7cd126178d5a18862d3a29640b4d903d58aa74b2892fe3eaec452442dcd0
-
SHA512
c980ceb58c593484c172f10fc3b9da6ed45e2a4b7d928f47c3c7e4b8965959d9f459d15bc71575ab9f822ea03dbc779d0dde4f4806080cc804600c60fe011f97
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1424 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\README.md1⤵
- Modifies registry class
PID:4924
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1424