Analysis
-
max time kernel
141s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-08-2024 09:26
General
-
Target
.reloc
-
Size
2KB
-
MD5
0997c172bb70dafb06dd0d5f220b8ef6
-
SHA1
b101e5b21ca18127584725fc3d875e1e31f260bf
-
SHA256
df1ae66a3d747156c00913596a4313eb8814fb627b21c424d3cb8baa257e27db
-
SHA512
a92d3ab2db442ff0a0c8c87ca2ac21dbac34bd355807a107942fcd02c4e8bf2a4e4746dd743033f3d16be797bc9a8b5a5d9380c83361435482e41af2336c4e02
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 33 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\.reloc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\.reloc2⤵