27e91e3f6b4b2c5853c59ad4cc8d5d0064bcefcfee10529382d5b6f38eb0977c

Analysis

max time kernel
114s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UltimMC/libLauncher_nbt++.dll.a
Size

149KB
MD5

10282f268ee475e3f0bae6a2ef027a38
SHA1

a0d3ed64da184b1d83675386076ba4daab22b60b
SHA256

ea382f202280e84d940b73e91b214d1cfa1dcad8946582fd67a59549b999fcb6
SHA512

8304149f8ad456a325411d8098204cdc1548e2e4f2d206f7a90da59c8e98dfd552703c242bf03b1642e156465c77489ac4ce03ff59c7a80ea9c733681fa60c64
SSDEEP

768:KPr973m9YIgiYVq/TaS90Xuw7BbwGPvKWFdeDUK7K+Dzsjh+uN5Ibe3xr9DKK+FF:er973mDK6Krswk8hV9U578Ymi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2884 OpenWith.exe

pid	process
2884	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_nbt++.dll.a
1⤵
- Modifies registry class
PID:3512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1044,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
1⤵
PID:3600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads