f60e689830b70645133be31e9db094e258da3ea96b0fd4190cef3c1d07e9643c

Analysis

max time kernel
593s
max time network
600s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Resource/AttachmentManager.admx
Size

5KB
MD5

a7f3bb7ecbcbaeba34ae99a473fc78d4
SHA1

35519185fd4a538d8ca1b9ceb46cdda78f6f1cd4
SHA256

5eca8151e2ebc1c5c3beeec2b6d79d16f54eb543fba45ed6e8cc6a7d3d5632a8
SHA512

9f8833d9e10013b8d092e999a3c0f4caa7bfbac6a725ec85e5bb4ad3ab99a6cca1a99899521603b0b9f0912e0ff0e2264f29898044c2d366282568d9fc148e36
SSDEEP

96:QeD/mDZK0ovKnKJrb5PwWA+P3WvwGFi1PdWhlhQWAsPOWA7dPlwwxbe1Pw5IFtX9:vYZJMfpYmPGsddWhlh4MiZBxbedw5IFX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Resource\AttachmentManager.admx
1⤵
- Modifies registry class
PID:2936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4112,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
1⤵
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4032,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads