af75b819a2e863bbbca76e6e284d5168dd71fdeee57546cac30b5e1393a66c45 | Triage

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12-09-2024 14:48

Sharing

Report Analysis Logs

General

Target

Cheat.zip
Size

94.2MB
MD5

ff51d5b7142b2991e495cc1563e0fa58
SHA1

2ac550e42fc83b8917800fee554a021c0b4b0a5b
SHA256

af75b819a2e863bbbca76e6e284d5168dd71fdeee57546cac30b5e1393a66c45
SHA512

70872433ffef4559801b96b1be75973045d8ebacf03fff1e8b658667f464086833a7006fc33b959e3b31790d010e4aa93bc26a3e2b0d43877e4fa6acf7e5a02c
SSDEEP

1572864:TK3AkMDxY01vUE7CIk1juMWkiJXdqUALrQGrGQdZsFNwV4C7gYJg8q:TlTvUE71kPHOd7ALrQG/dqFNwn0Iq

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4504	OpenWith.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Cheat.zip
1⤵
PID:3792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads