Analysis
- max time kernel
92s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/09/2024, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c74cb57c375c6bc50b869c5d502f2922c593cc77ac119181ec680d32d67c49e.rar
Resource
win7-20240903-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c74cb57c375c6bc50b869c5d502f2922c593cc77ac119181ec680d32d67c49e.rar
Resource
win10v2004-20240802-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
doc_0300304032000.JPG.exe
Resource
win7-20240903-en
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
doc_0300304032000.JPG.exe
Resource
win10v2004-20240802-en
11 signatures
150 seconds
General
- Target 0c74cb57c375c6bc50b869c5d502f2922c593cc77ac119181ec680d32d67c49e.rar
- Size 1.0MB
- Sample240903-wdyb6stdkf
- SHA256 0c74cb57c375c6bc50b869c5d502f2922c593cc77ac119181ec680d32d67c49e
- MD5 d8452fead0ca6746b8d5254065e25639
- SHA1 db0b5bb20ef851adba8dc1644407e37a6cb5e2ff
- SHA512 2f3bee9611b7994bb59b1c08fec434511cef05d57344411e3ae77a3549b998d1cb2d0504df1cde57f356963ce64cab6cf681d023b4f59cc060b51384f6d3848f
- SSDEEP 24576:G5pyjpMSvCP3u93N4RsI6pcBmqjoRhowomBrQO:ay+SKW93yRsfc/sTowotO
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4844 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0c74cb57c375c6bc50b869c5d502f2922c593cc77ac119181ec680d32d67c49e.rar1⤵
- Modifies registry class
PID:5064
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4844