f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554

max time kernel
429s
max time network
1154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v2.bin(1).zip
Size

73KB
MD5

620fd461cab821f478f7cce1bf06d1ac
SHA1

a083516b5a275a2e9141f68a99ab4878632c5552
SHA256

f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554
SHA512

9ad7d4f17e156e21885c89b242430a06652ea8bdc45b22dc64f23efe8c2f6391ac5556c5e2bd14cf46d5bd8cb8dbb89f714466eef348dcb19ad16f3175dd3117
SSDEEP

1536:yJrdZ1PgFel3BJmc11f0MPxwX5o2CfFGm8SXZRObA:yJJZ1cKxJm+bZGCfFjpRObA

Score

1^/10

Malware Config

Signatures

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Ʉ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ꄱ烳᳸蠀㛒翸	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\.text\ = "text_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\ꄱ烳᳸蠀㛒翸\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\忮Ʉ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Ʉ\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\潬灯s	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\潬灯s\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\.text	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\忮Ʉ\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\text_auto_file\shell\edit\command	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3168	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3168	7zFM.exe
Token: 35	3168	7zFM.exe
Token: SeSecurityPrivilege	3168	7zFM.exe
Token: SeSecurityPrivilege	3168	7zFM.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3168	7zFM.exe
3168	7zFM.exe
3168	7zFM.exe
3168	7zFM.exe
3168	7zFM.exe
1224	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe
1624	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1224	1624	OpenWith.exe	93
PID 1624 wrote to memory of 1224	1624	OpenWith.exe	93

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\v2.bin(1).zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO06CB8368\.text
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO06CB8368\.text

Filesize
48KB

MD5
546a09ceb867e9e993b449f1497f46cf

SHA1
b7e2b841b52d91156c1b87a8cf2bda97ab22158c

SHA256
df5f40068d7a70785cffd4633f65097efcc13b991a98fd3d29bdc55288171aae

SHA512
08f871c7afdf8b67bb10cbf76e023f4b8a225bd8d8842044b4ce96c6e4368b8f09cd2d7a387f61d4317af9a77cf01706eeb5e88165178ba1d3f9256205638a30

Download Submit

Resubmissions

Analysis