a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Resubmissions

19/07/2024, 04:08

240719-ep92nsvgma

19/07/2024, 03:58

240719-ejs6za1hkr10

Analysis

max time kernel
138s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app/node_modules/child_process/package.json
Size 295B
Sample240719-ejs6za1hkr
SHA256 104f06b6ce2e379c3bb02cdfc1918edd3ee45e1fb3c8b5c4dcd0ab122675a964
MD5 c913f6d16eb753431d36ea482cacb065
SHA1 5cb1c8bdc60101846714e942758d888a008120e4
SHA512 ebbc2aa93b22df1e8cec1889022c9f7e54cf5dbdbe6568ae39c3cd355aaab154b9b8197238682dc36143fe5fe2d25f936adb21f5101dcb5aa6570eaa8ec35ade
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
224	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\child_process\package.json
1⤵
- Modifies registry class
PID:3932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads