Resubmissions

08-11-2024 14:28

241108-rsz24atfqk 6

24-10-2024 06:44

241024-hhl8taxepf 1

23-10-2024 13:25

241023-qpfnlsthpm 6

Analysis

  • max time kernel
    1151s
  • max time network
    1160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 14:28

General

  • Target

    AWS Secure Data Exchange - Compliance Check.rdp

  • Size

    14KB

  • MD5

    e1d7de6979c84a2ccaa2aba993634c48

  • SHA1

    f6fd182b93e54a3015b7d62a1a68554f9e2450e8

  • SHA256

    648afcc709ac18c4fe235d24bf51a8230e9700b97c3dcc0a739816966f2b58b6

  • SHA512

    7aeda74ef4ec0edaa94438fdb3f14114ba9b59c9f42d1abc208038684683cdc6616cb1125e869a34ec5d92db839e7ef6f9f814d781fb8dda8612b82487f2ba27

  • SSDEEP

    192:5LMVj0bf1gnx81liTNwxYorSEZo8/eVLYOauXozHgOjSzM2owMxnt93w97S3:uVjnnx81lmaxYmo8eVLYL7A6+Pyg9O3

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\mstsc.exe
    "C:\Windows\system32\mstsc.exe" "C:\Users\Admin\AppData\Local\Temp\AWS Secure Data Exchange - Compliance Check.rdp"
    1⤵
      PID:2044
    • C:\Windows\System32\mstsc.exe
      C:\Windows\System32\mstsc.exe -Embedding
      1⤵
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads