Analysis
-
max time kernel
22s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
27-01-2025 00:46
General
-
Target
Skript.gg
-
Size
226KB
-
MD5
ca7d5d7de11cf29e438bdcb23858e9c1
-
SHA1
648c94253ab48ee91220ff9703c6f609b5a00eac
-
SHA256
bd2759318864a15bb6b3f2fe941acd6042ddb728d8a1f7a7ef2136696dbf37f9
-
SHA512
b3041bfe3f2c708a5f4dba468eadb90a3984cc7cd9d3aa77673c94dbe929f67d8aaa1248f26fca0734b9b1fce24bbe45b3f693a29b31b5d93407ef51413fd3f5
-
SSDEEP
6144:ghN5ipOL/saqkPV9FH2LtcIDSsmwQ9mvZJT3CqbMrhryf65NRPaCieMjAkvCJv1k:cN5ipOL/saqkPV9FH2LtcIDSsmwQ9mvN
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 20 IoCs
-
Suspicious use of SendNotifyMessage 20 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Skript.gg1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB