860a1bafa27533b8ba73a7e0303fb83263129ca28672dc7d2c71d126ceee0688

Analysis

max time kernel
132s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-07-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MegaLoader FIXED/FtEaCrack.dll.config
Size

806B
MD5

b9cf91b1a28bf318b8081eb7a782bd55
SHA1

1228320f178c54fc35ec4b07c312fada0f4fbe7a
SHA256

5dd16563498d44a8be1f0288f2f77ad61f1b976eb07cdf8f99b37a7cc489a1e3
SHA512

e99b8863da2aae9019419c815834921490d9afd18745d44da476bf8878a4ff19b5ce896b5de7a4ce251c589725872a00a458d5a17e82bbef0e72eb05b04cc3f1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.config	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.config\ = "config_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\config_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
508	OpenWith.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe
508	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3708	508	OpenWith.exe	75
PID 508 wrote to memory of 3708	508	OpenWith.exe	75

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MegaLoader FIXED\FtEaCrack.dll.config"
1⤵
- Modifies registry class
PID:4688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\MegaLoader FIXED\FtEaCrack.dll.config
  2⤵
  PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads