ef535a90f6918183f35272421411ee22c7700beabce9f2ad4b685e52a6408a9d

Analysis

max time kernel
90s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/08/2024, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test/gs_gcm_hello_world.elf
Size

334KB
MD5

27f56fd0a6c44113826951145f9a56e6
SHA1

6e135ba731bed6455331637339c6472b1020a78c
SHA256

0760fd741d0ba7fe7f6d20a901912b60e4f8e74d5cebc84f9a48c2a74b616617
SHA512

61ea51ae132689c47d138b5c4071f4328eb599b6f66314a0e660854d612cef8d16aafe0c69b932785caddd7818e30f6186f064f88b29401496e5f1c0c20e628b
SSDEEP

6144:2b47nJ8ORusLGHXaWeQnTLPmRatW77X4/OWH:LuKu7TmRap

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test\gs_gcm_hello_world.elf
1⤵
- Modifies registry class
PID:2368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...