Overview

overview

3

Static

static

1

av-evasion.7z

windows10-1703-x64

3

Resubmissions

15-07-2024 07:22

240715-h7cexavcml 3

15-07-2024 07:20

240715-h6h63avcjk 3

15-07-2024 07:12

240715-h1l1rsxcpe 3

15-07-2024 07:10

240715-hzfscsxcke 3

Analysis

  • max time kernel
    29s
  • max time network
    17s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-07-2024 07:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    av-evasion.7z

  • Size

    35KB

  • MD5

    e0fb582941f9576750310a24d793b000

  • SHA1

    ae9d0b7db6889d6c570ae67358734a0c0d76010f

  • SHA256

    23dc59dba862efe257b3dd5f7d04cdbb1f6aff7de2c7f5df7ad1d4614a9f6f79

  • SHA512

    d2dbbc68e16f3a441a00b4b8be1d46ffb60862a93827466d0092e53f04bc204b96c22071c42b94fee130c77d4929bd6929288fba7c54d82dcfda032b1be9cd58

  • SSDEEP

    768:2FaYYBb/cLN+wWD5SWcH3+6EiX2Bj7mzbtuip+pw4PCwXItCjHA6zSKMh:2FaYW/cLNyD5SZH3tFG1k8ipK7attW/G

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 49 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\av-evasion.7z
    1⤵
    • Modifies registry class
    PID:2720
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads