Analysis

  • max time kernel
    38s
  • max time network
    144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-08-2024 10:04

General

  • Target

    $PLUGINSDIR/select_bg.bmp

  • Size

    59KB

  • MD5

    ff051f124f5d85f23efd007c9ae2e465

  • SHA1

    c6f0adbf30888e8ba5a6ade5dfb3d43e773f9a75

  • SHA256

    4b1f2c35e4f53778cee78a84c64d0a44e3bf5c1a751ff8a66d16c47bb7e082eb

  • SHA512

    523c864ec9eb6a289c65e5160b6eae3437500b950865398e841c05378a2497c5c7db31187e01b7295b12a49c47c18809908d5ceb55f5ba3043d81577c3b358f8

  • SSDEEP

    6:5A/6BTZaRah8km8WpS4zo3BaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaa4:5Ai3y8Wg4zoX4zoC8WMa0d

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\select_bg.bmp
    1⤵
    • Modifies registry class
    PID:1016
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads