1e8e8427ed280887d2d55abb7edfa766b00ee78c7ff5b8e6bce68ba1d81dce9b

Analysis

max time kernel
150s
max time network
280s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

-65894-DEMANDA LABORAL- JUZGADO 02 PENAL DEL CIRCUITO RAMA JUDICIAL-01563.msg
Size

463KB
MD5

cef24456ba2aec07230c9737abe382f2
SHA1

d25fffeb9b479f1450dc4c2383b56eb5618a4545
SHA256

1e8e8427ed280887d2d55abb7edfa766b00ee78c7ff5b8e6bce68ba1d81dce9b
SHA512

fc21a0cce92dc492f436d35862bb7f6016a044f58a086b73e7c1f12607a8e77a42fb9890e2b485f7cf3f7a7181a56ba84e56beda12c2825249c59e3958c2b027
SSDEEP

3072:k1qpF3ETKIx3CkLBpCoMXyV1d/Cl+XlwdgrJGwS4BHKlger6unuFbmeqX2Mjvx5V:kYXETK03fBpCoK21dE+XlpJGwSsKldA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3676 OpenWith.exe

pid	process
3676	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\-65894-DEMANDA LABORAL- JUZGADO 02 PENAL DEL CIRCUITO RAMA JUDICIAL-01563.msg"
1⤵
- Modifies registry class
PID:1444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads