945c56bd8838b4285eb62c45ce4c756bfa02c02236e59b3ec1f24300a5e03b5e

Analysis

max time kernel
7s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/08/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.rar
Size

4.8MB
MD5

6286f2e8c90b71147a125bb12e22a15c
SHA1

ca8d05fe9589e689deb74f3cb458652bec42a581
SHA256

945c56bd8838b4285eb62c45ce4c756bfa02c02236e59b3ec1f24300a5e03b5e
SHA512

54c79a44e06dbdc91453cbc26d56c6547f62c3decae0a382e1f2c71b444f1898cead52c1c7679663dd98bc0e9fe324f8dbbc7845b03478d494a8320d70279f7d
SSDEEP

98304:TCdEQoK2SDiV/f/J6mrhGO8PDj7L04xgOfgxaBevOX/qUO:TCRiV/J6qhapg0gM4mXyUO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	OpenWith.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe
2332	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.rar
1⤵
- Modifies registry class
PID:4052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...