50218cd76716ccb1250f1a491cf26c883fdd18cd78b68c385649d3bbcf8c5cb9

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-es
resource tags

arch:x64arch:x86image:win7-20240903-eslocale:es-esos:windows7-x64systemwindows
submitted
29/09/2024, 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

text/minieffects.pt.yaml
Size

810B
MD5

7084c109ef36996e287337134813dcdc
SHA1

6be7f00cfa222d0de4f14c45f911ebcbd40ce0eb
SHA256

97c0e8607e59ffdfec47ccc526546ac89a9d3e399226fb923c2e2f66cf1b078b
SHA512

5927cbef938008de2568f3b5f07f88211d4d41ada9ebcbfff78880c971325fecdffa34089dd7a5b56998f4b5ded5b0c4dab110d49da7fb7a1f0027cd9edb9f55

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1944	2836	cmd.exe	31
PID 2836 wrote to memory of 1944	2836	cmd.exe	31
PID 2836 wrote to memory of 1944	2836	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\text\minieffects.pt.yaml
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\text\minieffects.pt.yaml
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads