7b789067fc92947c089c7bd54324742156f04d7a2d670de4e5170c87abf72f3d

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2024, 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_internal/i18n/search_files.sh
Size

84B
MD5

aedeefef2e6623a467137a9f0b58a7d5
SHA1

e226df2a7ae35d20fd1e8f29c8f31f4ad66d6111
SHA256

73062905687f5929fc078e8512981efd6a410a0b7bcc716917d09a293f39cb03
SHA512

d40c793da09ae048aab2531e09f1352ca7e38b3804f2baf3f4052418134adcea7a3152952b0cbabc06c797a4e9905100a094fccf4c9d3e2c6259f4a942981d47

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
388	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_internal\i18n\search_files.sh
1⤵
- Modifies registry class
PID:3804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...