Overview
overview
7Static
static
3cudatext/cudatext.exe
windows7-x64
3cudatext/cudatext.exe
windows10-2004-x64
3cudatext/c...32.dll
windows7-x64
3cudatext/c...32.dll
windows10-2004-x64
3cudatext/c...64.dll
windows7-x64
7cudatext/c...64.dll
windows10-2004-x64
7cudatext/d...++.vbs
windows7-x64
1cudatext/d...++.vbs
windows10-2004-x64
1cudatext/d...te.vbs
windows7-x64
1cudatext/d...te.vbs
windows10-2004-x64
1cudatext/d...ipt.js
windows7-x64
3cudatext/d...ipt.js
windows10-2004-x64
3cudatext/d...t.html
windows7-x64
3cudatext/d...t.html
windows10-2004-x64
1cudatext/d...y.html
windows7-x64
3cudatext/d...y.html
windows10-2004-x64
3cudatext/d...n.html
windows7-x64
3cudatext/d...n.html
windows10-2004-x64
3cudatext/d...L.html
windows7-x64
3cudatext/d...L.html
windows10-2004-x64
3cudatext/d...sp.asp
windows7-x64
3cudatext/d...sp.asp
windows10-2004-x64
3cudatext/d...ult.js
windows7-x64
3cudatext/d...ult.js
windows10-2004-x64
3cudatext/d...ult.py
windows7-x64
3cudatext/d...ult.py
windows10-2004-x64
3cudatext/d...lt.vbs
windows7-x64
1cudatext/d...lt.vbs
windows10-2004-x64
1cudatext/d...ml.htm
windows7-x64
3cudatext/d...ml.htm
windows10-2004-x64
3cudatext/d...p.html
windows7-x64
3cudatext/d...p.html
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 07:41
Static task
static1
Behavioral task
behavioral1
Sample
cudatext/cudatext.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cudatext/cudatext.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
cudatext/cudatext_shell32.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
cudatext/cudatext_shell32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cudatext/cudatext_shell64.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
cudatext/cudatext_shell64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
cudatext/data/autocomplete/C++.vbs
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
cudatext/data/autocomplete/C++.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
cudatext/data/lang/translation template.vbs
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
cudatext/data/lang/translation template.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
cudatext/data/lexlib/Bash script.js
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
cudatext/data/lexlib/Bash script.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
cudatext/data/newdoc/Frameset.html
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
cudatext/data/newdoc/Frameset.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
cudatext/data/newdoc/Glossary.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
cudatext/data/newdoc/Glossary.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
cudatext/data/newdoc/Redirection.html
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
cudatext/data/newdoc/Redirection.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
cudatext/data/newdoc/asp with HTML.html
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
cudatext/data/newdoc/asp with HTML.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
cudatext/data/newdoc/asp.asp
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
cudatext/data/newdoc/asp.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
cudatext/data/newdoc/default.js
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
cudatext/data/newdoc/default.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
cudatext/data/newdoc/default.py
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
cudatext/data/newdoc/default.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
cudatext/data/newdoc/default.vbs
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
cudatext/data/newdoc/default.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
cudatext/data/newdoc/html.htm
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
cudatext/data/newdoc/html.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
cudatext/data/newdoc/jsp.html
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
cudatext/data/newdoc/jsp.html
Resource
win10v2004-20240802-en
General
-
Target
cudatext/data/newdoc/default.py
-
Size
88B
-
MD5
92df6d9e9ee43410beb969f3d61d62ff
-
SHA1
ca4bcc5755f1d33b6b4b5890203098e3cc8a5097
-
SHA256
96af7945ebb6dbe4d875dcc6c1b39a4e2800ab93dd527c36eb498ec088dfd1e8
-
SHA512
f3888ed61d02760b5537a318d6480ed16a315371a0d49f01d6561843de12888c18547dfdc21643f4675e457262174af2947b4643e8e18bda910ef2ef97cc2c68
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2484 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cudatext\data\newdoc\default.py1⤵
- Modifies registry class
PID:4712
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:81⤵PID:1916