87e3af2826512db33e2877ec799f576a13a6853a9839532278f02d4e548e7424

Analysis

max time kernel
160s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.a3x
Size

940KB
MD5

89859fe83e74915fb209fa52e33e3a47
SHA1

b13c90a7f9254201cdd17c07815a4de45df7db34
SHA256

e71958c62ba67d82e6695bb05b726c1e00541428bde8f800979e984e1593e534
SHA512

443359ca92191c7f3dbd8106f3610130898c083dfb2d43210587dbb4b213075807f51b59e8b12d634ff0ab327257f9140831e36ffff3e028533c79c209813081
SSDEEP

12288:ct+FIIcCcNi+B7P1K4y5IkjTVRTdCtjUkfAX3+nLz3J77vzYsb:c/IcCcNi+VP1JFZJPcsb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

4748 OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

OpenWith.exe

pid	process
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\script.a3x
1⤵
- Modifies registry class
PID:1332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4748

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads