74544a16f620605e4812a5e1b9615388f2daafe0af8d96060d1d0a289cc3c656

Resubmissions

20-12-2024 03:49

241220-edjqcaynaz 10

20-12-2024 03:47

241220-ecbcksymgz 10

Analysis

max time kernel
300s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.json
Size

4KB
MD5

090a7688f5a923bc032eaff7c0e2d0c5
SHA1

70d8898029400499c947be2193ff391bf5cc2333
SHA256

ae8191f550594cc8d652d9041aed4a9d82ee832733c01d5888bf6052517fc16b
SHA512

e8fbdc0d7c4bf7c33f0c5cbd00262f1d766584d0c5cdeedb658003b9bf266e5ea06be4b96f8af99dba8d5cafa856adc1db46666b0fb093272232a03afbace3df
SSDEEP

96:CtWTGy3BQ0K0qu125uGd0L+of0qCvfnCZCPY6f:Lgukv0pCHnCZCPYG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1240	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\config.json
1⤵
- Modifies registry class
PID:788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads