1d989142a45dace91e5c7f9c286bef5a91b50bb0b6902c8d5cfff654d714df9f

Analysis

max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23/08/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plagued PBR Deferred/fogs/basalt_deltas.json
Size

784B
MD5

b6eda85fd69c2c4fd69084e267cc9909
SHA1

ef204ea6f953a2d92cc964b94c354be976490ae4
SHA256

62817ceb012905763c09761653e3c9ca287c38f55b03af349783cace7c70b237
SHA512

e55b8161ac8404455023c4dce8da74c0b52c2fc4cc78ca53d393e98c4268fbcdbc9899ea102cb0433153a94e8fe0d3d2935faf5ae2a91d24e9cc3cf077ea909f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1560	OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe
1560	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4872	1560	OpenWith.exe	95
PID 1560 wrote to memory of 4872	1560	OpenWith.exe	95

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Plagued PBR Deferred\fogs\basalt_deltas.json"
1⤵
- Modifies registry class
PID:3972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Plagued PBR Deferred\fogs\basalt_deltas.json
  2⤵
  PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads