15b8ea286ec25a55cfba25409a30533ce8026ba440eff6234b121f5b1fb37adb

Analysis

max time kernel
97s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2023 18:46

Target

Best Instagram Bot 4.1/Application Files/Best Instagram Bot 4.1.exe.manifest
Size

7KB
MD5

b6c12a703d50ab80f2b73b1f897db3ff
SHA1

d8299cd39d8dea624647bf09b3311e46a159a13b
SHA256

6e292bb22f8edda3d73f6c87131497095fae25ac38c4844bcfee2543adf3ffbd
SHA512

1d0c127cde504ccb391ae680092d491dafd8877bbe7971c7e813e2228a8b8dc33175bc54acc04f0cc113b5f900de12c58763ad2bab4c69dbcc94325df7610860
SSDEEP

96:xWtyb1jh8Q/k0XO/1tYcAe3SydDxk2kPCOFmO1MQ+jBE2DFdLAaBDA:o2ArYcAeqnPlkLX0cA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4244	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\Application Files\Best Instagram Bot 4.1.exe.manifest"
1⤵
- Modifies registry class
PID:1196

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact