1b092e036c2166e901393b46c088d10c3e7620bbc57fe86fa1fef04385fbf9b1

Analysis

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16-11-2024 18:55

Target

DarKnetJoKer.apk
Size

8.5MB
MD5

1d4fbe75708e3b9f917771ee51c6b579
SHA1

62f30155ab29bab3b838b9381ac9cd97e8a86d9b
SHA256

1b092e036c2166e901393b46c088d10c3e7620bbc57fe86fa1fef04385fbf9b1
SHA512

b068b9be44e13eae565e12afccffc85a6c369aea23767d213727e61997be96949225d506ccf07aecc99e3841877f2009ce27aa73d1f439c315a2c35ad294298e
SSDEEP

49152:VBe2E8SKj+Ahu8NAgIaCpTro18nqWE+s8E2mz5zdGGIQTOjfUtYqi0cgFES4:j+8S0+AtAgRCpTs1Z8Bmz5zBPTU0tFC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
792	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DarKnetJoKer.apk
1⤵
- Modifies registry class
PID:3528

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact