809f6517480548b9976840145ff402d2598cdf6cc7bc210646306957ca41032e

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

icudtl.dat
Size

10.0MB
MD5

3f019441588332ac8b79a3a3901a5449
SHA1

c8930e95b78deef5b7730102acd39f03965d479a
SHA256

594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
SHA512

ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
SSDEEP

196608:gmXwSv9AAQMlptodliXUxR0rHf93WhlA6tnoB:gjKlQMlpgliXUxR0rHf93WhlA6tnoB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4636	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe
1568	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4636	1568	OpenWith.exe	91
PID 1568 wrote to memory of 4636	1568	OpenWith.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\icudtl.dat
1⤵
- Modifies registry class
PID:2312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\icudtl.dat
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads