8226babff47d9ae4deb0e971e8bd7d7fdaf408ceabec26ed49344c769c35ff1b

Resubmissions

17/08/2024, 02:58

240817-dgkalstdjb 3

17/08/2024, 02:53

240817-ddal1awgln 7

17/08/2024, 02:50

240817-dbzhcataqh 3

Analysis

max time kernel
30s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17/08/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RBX Alt Manager.exe.config
Size

1KB
MD5

91b3eb65e464ec0ef6e353a43051c795
SHA1

db30ed1efabe0c1a83ab6cd024cff57345e1c2a1
SHA256

a0df215ec480a1ec736664f29519c90fde0473c8d9c22074330fdceaf9d52727
SHA512

764554aa97caa37c54b4e811f3ecf57a3403fc3c3a8343fefc51f5d1c01e6b6e5cfb0aaa8fd16cf1e13b822f4d3a7c29da509d40cb74574e7b4690bec391b2a2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5080	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RBX Alt Manager.exe.config"
1⤵
- Modifies registry class
PID:3848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads