Overview

overview

5

Static

static

1

153c07204b...in.jpg

windows10-2004-x64

5

Analysis

  • max time kernel
    421s
  • max time network
    438s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 04:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    153c07204be0aa6d646eeda938e57528-min.jpg

  • Size

    805KB

  • MD5

    7a2dbbeeb5ef08bdc937e76f3f3531e7

  • SHA1

    5e103b2dd0a49a12bc2e9f427faccce257e9d3d4

  • SHA256

    f3431fc06e6523b80b2a511c59c5c45575fa6a36e58d43dede9086c87d698c35

  • SHA512

    dddbee4dda1c02bc70295f785008586cd4c05739cf27cb92f302b70187c5ffe54b1c7276c1ed5d5fad369974272c18cca678882edac34a7007a3adcc52000f06

  • SSDEEP

    12288:tPOXcmzwtB5v78jG89Sp+oHaJCUcsIP7GbryACi2QKR6dVP25BcQhZS64VOO3No:cqB5v7EGVmCUEspL2QhPQcaZS3sOG

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 57 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\153c07204be0aa6d646eeda938e57528-min.jpg
    1⤵
      PID:2560
    • C:\Windows\system32\SnippingTool.exe
      "C:\Windows\system32\SnippingTool.exe"
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1864
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Capture.PNG" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4544
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:4616
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:372
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1952
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\system32\dashost.exe
        dashost.exe {1c1502f7-a6a4-4326-a5f56db8baf8292e}
        2⤵
          PID:4848
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\system32\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Capture.PNG"
          2⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4016

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\Desktop\Capture.PNG
              Filesize

              29KB

              MD5

              119d442fe454302784ddacb73e5e0596

              SHA1

              447c2f161678023ce2b122ea934e00283f0821c6

              SHA256

              c232ba5cafaf8a663ce9cf19fad5903466f542d0fcdbdb7dd6fd7f557cd25264

              SHA512

              c037cba5286ae41f4ef3e5ae495e160249a932ac6bca66c021ca7d118a89e181e69436b93600e1a33455449fedd4b26e18a56d2e532d661f82482bb5ef6bb589

              Download Submit

            • C:\Windows\Debug\WIA\wiatrace.log
              Filesize

              4KB

              MD5

              ef3e62977631394aca72c93ca52eae0e

              SHA1

              5b7fb9873372e25edd946f18bfc5b51c59e52e36

              SHA256

              78b8c458b514afc6ef9c8e0de0c8c7e0080d3a7b28b53b7a681fa8572959210e

              SHA512

              f10efbd40d79771a50ee5936e5bef3fcdc098b62cab316d97011c64095eeb298337f10d5c4ab7e3535c8c14b8a7a7392a0ce5ecfb907282221738ed70c71852b

              Download Submit

            • memory/4616-5-0x0000023BB41A0000-0x0000023BB41B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4616-9-0x0000023BB4A60000-0x0000023BB4A70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4616-16-0x0000023BBCD30000-0x0000023BBCD31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4616-18-0x0000023BBCDB0000-0x0000023BBCDB1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4616-20-0x0000023BBCDB0000-0x0000023BBCDB1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4616-22-0x0000023BBCE40000-0x0000023BBCE41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4616-21-0x0000023BBCE40000-0x0000023BBCE41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4616-23-0x0000023BBCE50000-0x0000023BBCE51000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4616-24-0x0000023BBCE50000-0x0000023BBCE51000-memory.dmp

              Filesize

              4KB

              Download