b45ef6fefedcc3ce7e4622f8544bbf5b500fbf9197ec713217fdfe5bb530656b

Analysis

max time kernel
80s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 18:09

Target

LostLife_1.51/LostLife_1.51/lib/m1.swf
Size

38.4MB
MD5

f402f283b08ed8fcf93137d45fdb8b5a
SHA1

a7390cedc8daf202abd08ff4a9398f75476fa931
SHA256

6ee2e086176ac021c361693d9572e956bc2fd48e977aa58b90dcda46b28e65cb
SHA512

bbd11b3eb36dbd436f1988d5d433918e7d1b164147cb32bea8b79a98f8f50a07618720e8a6017eaea5a92c14b9c8f6b13df7c403ef824befbfdc9be5c41dc556
SSDEEP

786432:3v2P0DwbeDD9MIGsrwbULegFCzsREhGIVdF1tI+om8X9ZnZJsgK4b8Q13VBTOzpq:3vbDxDDyP4wAL9FCzsOGcdXtIA8Hz5bV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LostLife_1.51\LostLife_1.51\lib\m1.swf
1⤵
- Modifies registry class
PID:680

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact