e37f94ddacee5d07de6487168d38beace0519df62f5799fdc15b520ee719d87e

Resubmissions

21/07/2024, 23:01

240721-2zkk4a1grk 3

21/07/2024, 22:56

240721-2wpqmsyfmb 3

Analysis

max time kernel
1679s
max time network
1140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v1.11.2
Size

177KB
MD5

c22ccd7d307b26818b9e0f18dbe4b516
SHA1

d3e3cef1bdd13f56d35be1020dec70569418221c
SHA256

e37f94ddacee5d07de6487168d38beace0519df62f5799fdc15b520ee719d87e
SHA512

04f9820724a42958a7243a8d4eb15a3d452252b643fff43882de2e2c5db03226153ad58a5336046f5102f7db6b2612ca891fd46317d944bfb6b06b353e028d5d
SSDEEP

3072:gFHLya4KM82VinYuccok8ValLPfkghqSaCA6cKEvVuFNt0MMh3hjwJ0p6oNNt0MQ:xYohtREc4kuX96h1LBJz086v642Z9ev9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\v1.11.2
1⤵
- Modifies registry class
PID:3240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads