15b8ea286ec25a55cfba25409a30533ce8026ba440eff6234b121f5b1fb37adb

Analysis

max time kernel
74s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2023, 18:46

Target

Best Instagram Bot 4.1/usersys/Application Files/98p.ico.deploy
Size

87KB
MD5

a098b32ebc940d092779e2e488036d68
SHA1

d4c85bbdc0b22e4013d7b46b79ce63234a29ee07
SHA256

4ac78ea8f26fcb0ce273e96be03018a73390efefe00a37480f9371712be072c3
SHA512

6dbd7507fa4bf5859b37f0a5b23dc93786251a42ce7cb41d8bb6d315cd364c6efa52a053c09fc7011042f23e77c2e6d8cb7672d47c1429d625325c7c2c4bc5e7
SSDEEP

1536:f+sskTN6tT58MkdHMAJy2haS1i+SbNIGjgnIbuI/kqy+p:WiSTxkNM8hahbNIG0It/kqyG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Best Instagram Bot 4.1\usersys\Application Files\98p.ico.deploy"
1⤵
- Modifies registry class
PID:2652

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact