5838f38e80657dd318bdbcfd1bdb87181e527f2125185ce95b43abd02badea86

Resubmissions

19/08/2024, 21:30

240819-1cvl4s1aqk 3

19/08/2024, 17:51

240819-we6d6sxfrb 3

Analysis

max time kernel
312s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Update_2762895.msix.appx
Size

7.1MB
MD5

18f827c6f0b3522fddf6c436e61a9a9d
SHA1

b949866438f2044a4318ac8a0826b50e6201f00d
SHA256

5838f38e80657dd318bdbcfd1bdb87181e527f2125185ce95b43abd02badea86
SHA512

357f37a20b46359ed0349733cc5465c00d1e179e10a16c765e566c71ec1ac38971d212066242f774362cd4f1fdf8a62fa65062ed4d2a05d9a4ce6e0a2c9de401
SSDEEP

196608:MfFCy8ANI7CnLhZKfhEfy4HMLoWKSJTwfpYGA/2MH8jjl:MfvLXLSfht4HQJ0fpYrDWjl

Score

1^/10

Malware Config

Signatures

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
376	powershell.exe
376	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4832	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
4832	OpenWith.exe
5068	SystemSettingsAdminFlows.exe
4816	OpenWith.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:AppsFolder\Get-Content : Cannot find path 'C:\AppxManifest.xml' because it does not exist. At line:1 char:800 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (C:\AppxManifest.xml:String) [Get-Content], ItemNotFoundException + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe' is denied. At line:1 char:800 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Windows\Syst...e_8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe' is denied. At line:1 char:800 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Windows\Syst...t_8wekyb3d8bbwe:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Get-Content : Access to the path 'C:\Program Files\WindowsApps\MicrosoftEDGE_4.12.136.0_x64__4s6hj47a1rw6c' is denied. At line:1 char:800 + ... ackageFamilyName;[xml]$xml_data = Get-Content -Path $xml_path;$appx_t ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Program File...__4s6hj47a1rw6c:String) [Get-Content], Unauthorized AccessException + FullyQualifiedErrorId : GetContentReaderUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand Microsoft.MicrosoftEdge_8wekyb3d8bbwe Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe MicrosoftEDGE_4s6hj47a1rw6c !
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:4428

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:4616

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock
1⤵
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lapyhha1.rjr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/376-27-0x0000016FA4880000-0x0000016FA48C4000-memory.dmp

Filesize
272KB

Download
memory/376-28-0x0000016FA4950000-0x0000016FA49C6000-memory.dmp

Filesize
472KB

Download
memory/376-29-0x0000016FA48D0000-0x0000016FA48EE000-memory.dmp

Filesize
120KB

Download
memory/376-31-0x0000016FA48F0000-0x0000016FA4906000-memory.dmp

Filesize
88KB

Download
memory/376-33-0x0000016FA4870000-0x0000016FA487A000-memory.dmp

Filesize
40KB

Download
memory/4516-0-0x00007FF960203000-0x00007FF960205000-memory.dmp

Filesize
8KB

Download
memory/4516-1-0x00000272D0800000-0x00000272D0822000-memory.dmp

Filesize
136KB

Download
memory/4516-11-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download
memory/4516-12-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download
memory/4516-13-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download
memory/4516-15-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download