371edb664c31555dac5e695b0f7286115dd94b380c188948bde2f167f030a7d3

Analysis

max time kernel
90s
max time network
207s
platform
windows11-21h2_x64
resource
win11-20241007-de
resource tags

arch:x64arch:x86image:win11-20241007-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
19-11-2024 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial Grabber.v1.03/Mercurial/Program.cs
Size

510B
MD5

d8692b1ad102280d59843e358fdcc9fa
SHA1

4d5b44762c74ceff17323f8acd553f6af527fe79
SHA256

f5b656e5ecc1cf14bcc9fcac75dc48ed0b8a04f6a2e47d088eedcd6249ff1913
SHA512

df09655bdbe6610fd99cdc02bfdee44b46e1dc72aca245d2685e32935787da23d6ff34058161f74f059080641e5cdcd6e6f83c847f2f168ed7a9a2f725d026e2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3260 OpenWith.exe

pid	process
3260	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.v1.03\Mercurial\Program.cs"
1⤵
- Modifies registry class
PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads