dac651edd381388ce17e6c5a7c5f41c66a42530e6ce82e58745adbd3c2570b14

Analysis

max time kernel
260s
max time network
276s
platform
windows11-21h2_x64
resource
win11-20250218-en
resource tags

arch:x64arch:x86image:win11-20250218-enlocale:en-usos:windows11-21h2-x64system
submitted
18/02/2025, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mars/panel/includes/loaderload.php
Size

1KB
MD5

5536aae055f7a65d024ae63f7131030d
SHA1

2974297a368cb22c0a30739af89ba78606b501d9
SHA256

775068a1549412efdeee6d3e1746927b41a1535f619c118b7cdb009f1ff276cb
SHA512

661ff8ce70dba7256033197d9b42a21f994a9a6f5b3ee4fa89eb134aa391382c1f17554c2603c67e5c14a52b5553f99b1350108e88ce18844365ed8f5a2e542d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3600	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mars\panel\includes\loaderload.php
1⤵
- Modifies registry class
PID:3672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3880,i,4634074957638558700,2080510381543222728,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:14
1⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=1640,i,4634074957638558700,2080510381543222728,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...