4b0c097dfd6d7c94b6288d49a216f57919982ea31f8dda97a1f62a21e7041435

Analysis

max time kernel
504s
max time network
1228s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2023, 17:13

Target

Main/META-INF/AIR/extensions/com.flut.rpcANE/META-INF/ANE/Windows-x86-64/library.swf
Size

966B
MD5

22a242a4d9835791527384cab1d68230
SHA1

91dd4843f6e2e97a6d282361af6da5f206f5a8e8
SHA256

d9091de10545cd6ab25f11574cd6280129c913261e9fb2c3b6ac1314cb81978b
SHA512

0ed07cfdcd5dfd0bcb8370be17d25dcb785cff11a1fe235b68e72e471da398dbe69194bba7090d305d1e581a1a402fbec691cbb5efbbb8c0bf6c0b439db05e75

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Main\META-INF\AIR\extensions\com.flut.rpcANE\META-INF\ANE\Windows-x86-64\library.swf
1⤵
- Modifies registry class
PID:1992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact