Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
27-11-2024 18:35
General
-
Target
Forlorn Executor.exe.WebView2/EBWebView/TrustTokenKeyCommitments/2024.10.11.1/_metadata/verified_contents.json
-
Size
1KB
-
MD5
f85ce0d2e1806c582954bd831378033e
-
SHA1
584222c390c8e9d0b85574083b89be48114b7f00
-
SHA256
e4fa2ded0327c43aa618cc751b8a8704cbec33cdbc28e5ff49d536d58226e5bb
-
SHA512
08a9f6c42a774287a883a745acf1a17327df19493248c69d8497b6a5ee1a5e9310fb756a3c4c7665624929d4387bf365cae5f6100aa873c04bff2b56932be4a8
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Forlorn Executor.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2024.10.11.1\_metadata\verified_contents.json"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx