26f6af63d50641c16e65d7fe22e8675e0ecd4ffddf9fd1fc3652d862ef4e8f8e

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2023 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x64.elf
Size

130B
MD5

b56959ff164d8f7ba900dd34b6441e96
SHA1

4ac524eb4b5a1393e815148bc15f1eb92b368924
SHA256

26f6af63d50641c16e65d7fe22e8675e0ecd4ffddf9fd1fc3652d862ef4e8f8e
SHA512

ebce3ea370d67f5a9202babc2fc58c5d9f1e301c3ca1de5ad30cb2e4273076005f2f8fa38d5340e60efffb03a894a462b6d88836fa82e1ba7205ca4169a57bd3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4052 OpenWith.exe

pid	process
4052	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x64.elf
1⤵
- Modifies registry class
PID:5040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads