eed01ced086890e690dbee6e4b789451d58941deff069a1224a1fb3edaca879c

Resubmissions

20-08-2024 14:55

240820-sad8casbpm 8

20-08-2024 14:52

240820-r87rwasbkp 10

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

manifest.json
Size

243B
MD5

8fe292f057c853fdd2897742cfe63592
SHA1

f9d65917437c1dfcd476a6fa62fa95061da6e6b4
SHA256

42ba9f88c6fffabc9bd304474596df586cd52efda1d960dbf086f577d02ac15d
SHA512

a65ac69dba971a610a0882fca8acac434673d06a03c714c4795a491a3674e5fc7967ec2cf107a89cbc53ae1a6191cd8f1bf28bb210d26bb73f1707296714212c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
840	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe
1308	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 840	1308	OpenWith.exe	99
PID 1308 wrote to memory of 840	1308	OpenWith.exe	99

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\manifest.json
1⤵
- Modifies registry class
PID:4628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\manifest.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads