3f45b4acd905e47dbc1357ec44040af6e1fcb68fd09d8bacccad0d729be1d5da

Analysis

max time kernel
1370s
max time network
1159s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ElectronV3.rar
Size

11.0MB
MD5

fae8140fc10e55657ec9998ed3f32a30
SHA1

d27f46d9e120453a13c7f29b3833ec8ab660d3db
SHA256

3f45b4acd905e47dbc1357ec44040af6e1fcb68fd09d8bacccad0d729be1d5da
SHA512

ef4fef5be5a9548446c385a948286e47b1582ce2c355324618b905d2572b6d3d44a5a79f1a73238439e6d2f941a0628b1e0d68b01c82c2a95ea81d6d7e70444f
SSDEEP

196608:EtWMBvqCsY56Pmf9niNjK1hP5dimc6O4kzIEYZa337rmcc3EV2c+LSneFrhf1Z:EggFs49i46xUh637AuVOS4rhf1Z

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
216	mspaint.exe
216	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5080	OpenWith.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
656	OpenWith.exe
656	OpenWith.exe
656	OpenWith.exe
656	OpenWith.exe
656	OpenWith.exe
216	mspaint.exe
5080	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ElectronV3.rar
1⤵
- Modifies registry class
PID:5104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:656

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ResizeSend.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4200-4-0x000001EE721A0000-0x000001EE721B0000-memory.dmp

Filesize
64KB

Download
memory/4200-0-0x000001EE72160000-0x000001EE72170000-memory.dmp

Filesize
64KB

Download
memory/4200-11-0x000001EE7A480000-0x000001EE7A481000-memory.dmp

Filesize
4KB

Download
memory/4200-13-0x000001EE7A500000-0x000001EE7A501000-memory.dmp

Filesize
4KB

Download
memory/4200-15-0x000001EE7A500000-0x000001EE7A501000-memory.dmp

Filesize
4KB

Download
memory/4200-16-0x000001EE7A590000-0x000001EE7A591000-memory.dmp

Filesize
4KB

Download
memory/4200-17-0x000001EE7A590000-0x000001EE7A591000-memory.dmp

Filesize
4KB

Download
memory/4200-18-0x000001EE7A5A0000-0x000001EE7A5A1000-memory.dmp

Filesize
4KB

Download
memory/4200-19-0x000001EE7A5A0000-0x000001EE7A5A1000-memory.dmp

Filesize
4KB

Download