dd5dc79c40412908394e524b912dff04727590e55135b05b9f934853f3b1178e

Analysis

max time kernel
1060s
max time network
1955s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 20:43

Target

Stargate Simulator/Engine/Stargate Simulator/SG/logikaSG.h
Size

74KB
MD5

99c17c9f22f31b02cc93d5d317f1a630
SHA1

0cea4127cb8c0bbe8c67348d25337d258cc79194
SHA256

282e4a51954ebb5baaa50044127811c87866ac314d6644cf297258043bc35b01
SHA512

d3efb6ea59f95634ff900376ac54e41f62cb894429a602b4c60791321a316a508c2ebcfa1dde79523f6ca3fa84974197de34a4ff2ba09fc5e1ecaa50aa3dd624
SSDEEP

1536:ljwqjMrmjHmq409g2qV1ELTpGfQMcXuaLL2IJ04j7uInyk6rmZXA22Sfn4IGz/eI:xIrWHmq472qV1ELTpGfQMc+aLL2IF7u/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Stargate Simulator\Engine\Stargate Simulator\SG\logikaSG.h"
1⤵
- Modifies registry class
PID:4600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact