Analysis

  • max time kernel
    120s
  • max time network
    138s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-es
  • resource tags

    arch:x64arch:x86image:win10-20240611-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    07/08/2024, 08:19

General

  • Target

    locales/vi.pak

  • Size

    551KB

  • MD5

    4c5c09cb7e6eb120c8019fe94e1ac716

  • SHA1

    f018e7f095605e21db24944b828cc3580cba863f

  • SHA256

    e7319ca18eba379772954132493bbabb448d4e97d755b85360ed337216b48800

  • SHA512

    d171ee83cf02a8904290a74df1224556887e41333b8a01fbd95f0cacc88d230195fbfb6f99f9e02573d4864b3c95b570a77c2a0b1e19324d2599925e40684807

  • SSDEEP

    12288:KwEm5WJNuE+ciwJFrAsUaBScxgsHlZ0JdHqRPzaM508ETCoFAi1PzisTm7oA:TAJoE+ciwJFgaTxgsHf0J4P508uCri1c

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\locales\vi.pak
    1⤵
    • Modifies registry class
    PID:2720
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads