e75a8a541aeb8df44cb7904829518dbc08675f9a2f58f0c5f88e130ca67b6a9e

Resubmissions

04-07-2024 15:32

240704-syl8vs1ard 7

04-07-2024 15:27

240704-sv6hbs1apd 10

Analysis

max time kernel
146s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
04-07-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

twstealer-main/README.md
Size

213B
MD5

ca590ff76610b5ecf5b5a90358a2f2b5
SHA1

e7419522512ef6b03ada80bc30c1523a6fe96cd1
SHA256

6b2fd37596c512ecf23863f3fe2ff672ce45401c341a55789907c43c5abe7a73
SHA512

b40875f4eb18ab8acc533eb57beaaaf670a7fb0d47c2bbe35f0587e2ae5b6b956ba35447670a00a7ab2b0b40d72990807090f5972651b9c8d18b2088b5e174e7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1724 OpenWith.exe

pid	process
1724	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\twstealer-main\README.md
1⤵
- Modifies registry class
PID:4768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads