dd5dc79c40412908394e524b912dff04727590e55135b05b9f934853f3b1178e

Analysis

max time kernel
1671s
max time network
1606s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 20:43

Target

Stargate Simulator/Engine/.vs/Engine/v16/.suo
Size

56KB
MD5

61d9ac25b68a65a13969ef729454f883
SHA1

a3392efda032c7fc72cf461ddadf35c72e264bfd
SHA256

9b99e8ebadff95a64059893fe4470076efd099eed7631fcb32822caee872e92a
SHA512

cd94490d22d4ca36194105e83892dd475f45d6368c964c727c2570b8d48e18c91f7241b435f20bc5fba750b14eef49cc80fc38d5bae97a10b386eda43daf4a2a
SSDEEP

384:zckphOPFhQEpRIk/IJgQbpDtF8D8IeIXtf0KRb5O5YMPPgAVP:zcaGFhQZhSmjFYRXtf0KbO+M3j9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Stargate Simulator\Engine\.vs\Engine\v16\.suo"
1⤵
- Modifies registry class
PID:1504

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact