4a2923ae1b1cb07a7d5bd054ab63e2e30607aa1d3756bcf783f2a19ecaf9948e

Analysis

max time kernel
366s
max time network
435s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nexus-MultiTool-main/Helper/Funcs/__pycache__/clear.cpython-311.pyc
Size

5KB
MD5

3dde2d45b4e5efbe8118d37b31248a47
SHA1

3f1fd66f652b717735bf538279256a4083be4baa
SHA256

cdd63df3f78b98db0db0c12d59f5479fc98e2cd90e880b886d138a8cb71eb936
SHA512

d9dde81c5c1843df7d082061c23c62c3c58ef35bbefed76ecc24057c6016596bc13ada2c438c56f8d5a3ddbd40e673ff82f446bcd63271120a2fe57f79d83922
SSDEEP

96:ZIVeCPRi+3y3YsIatZsiTtjJQzrV7nNWq+HnNct:Zv6RYAi5jJCncLnOt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4212 OpenWith.exe

pid	process
4212	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nexus-MultiTool-main\Helper\Funcs\__pycache__\clear.cpython-311.pyc
1⤵
- Modifies registry class
PID:2584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads