4b6b7a9406221d0f9d165293bce05c4be16e61e2cc19de7aa3c9644983760755 | Triage

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 04:37

Sharing

Report Analysis Logs

General

Target

extension.bat
Size

122B
MD5

528d00946ad63b43aae90d3e3b5c310b
SHA1

a10981315785df42613a6c9d27d01c2e1dfc1be0
SHA256

4b6b7a9406221d0f9d165293bce05c4be16e61e2cc19de7aa3c9644983760755
SHA512

559f92d1371252d832a436359c4af02df946b4960eb0b6774e4791653e5140a3e7482aa1566904e04e7c3b7c7b9c4c03149bf5597612360a57de13c8e74f5772

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lua	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lua\ = ".txt "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dll	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = ".bin "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ = ".Ink "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dll\ = ".exe "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = ".bin "	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4472	OpenWith.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\extension.bat"
1⤵
- Modifies registry class
PID:4692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads