ec0f02edde4086d5f3dad2cd8fe33bbea9d68245f0d75affe2135ae0270a4543

Resubmissions

18-08-2024 08:26

240818-kbzlnsxfnm 10

18-08-2024 08:17

240818-j6x6navale 10

Analysis

max time kernel
3s
max time network
5s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18-08-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads/C963AEC1-6D52-EB4D-61BC-64DB2602EE5F/global_options.ini
Size

12KB
MD5

84f6a8f7607a096ba9c0cb704ae6ac8f
SHA1

48d951cc741484e87fdb6d08924385f8e1ae340d
SHA256

d7724e06402a2b1fc49f95178c1f8f9006f9c6a0636a7be4e29cd5474339013d
SHA512

60ae5fc39691dedebeb0f4e31630be778fb893f1c868996fa9d3b7ba4dd15be389e9a41a395f979357ac2d72eff80caa2fada5614428c569c68ef14d415d4b3a
SSDEEP

192:G/GbtBCB7k3LfcMIH9GZgy6kMIyMwZfCspqSf3Q71bNEKAAiOU+35UI+:GeCtkpgy673fTt6UN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Downloads\C963AEC1-6D52-EB4D-61BC-64DB2602EE5F\global_options.ini
1⤵
- Modifies registry class
PID:3076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads