92d28026fc18875893b490f0874773f6e19d45fa8701c60e1995f518ebfb3366

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RiftInstaller.runtimeconfig.json
Size

267B
MD5

8b76a07345e5edceaddb7159c490cf03
SHA1

55911001e04e99dea946e7f43ce73e7caafadc18
SHA256

e8153794edaeb9e9eaf7db83e4cadcbb7963fe410371b2aac828863934d4fada
SHA512

b643ddf46879d524f0410b0fc57c12a76ff8f982bdd78fed247061e15eef342ed57ad59658ba6b1a0177f59e8b6424a0413d8f8c8785ab603b0ae91496273c06

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2868 OpenWith.exe

pid	process
2868	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RiftInstaller.runtimeconfig.json
1⤵
- Modifies registry class
PID:4720

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads