e95072562c830c0229bec8434ff8c8f227b3ba32f11bf6457002062f1992b250

Analysis

max time kernel
130s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 10:51

Target

SugarySpire_Dance_And_Cafe_Test_V1.02/data.win
Size

327.8MB
MD5

f9e89119d39c3edeebdb66d32dc5051e
SHA1

f3d8a545233b6a9847d6e02888b994644c02bc0e
SHA256

21c11311c25f868329670c616d3c588784ac083206d144362bf034966fe19f06
SHA512

ba5bac51bf787f6982201be07e3d5ac33ac521475b1cd1ae48959096a94c25934444ed3c0d0eb9978c9130030558b2b2e23bca46427d190da2376545c200b516
SSDEEP

6291456:slIE4M+WZIdJ2FI/mwfnsyNrTQLysRdhHzP5c2hLRrYz2So:OIEN+eI4QnsUrTQmyzRcmqzA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3436	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SugarySpire_Dance_And_Cafe_Test_V1.02\data.win
1⤵
- Modifies registry class
PID:3556

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact