6432c9cb0eac5654c6c0cd987298e294b1413e22f7eb2a4a1a06c5ec7566e35e

Analysis

max time kernel
88s
max time network
35s
platform
windows7_x64
resource
win7-20230703-es
resource tags

arch:x64arch:x86image:win7-20230703-eslocale:es-esos:windows7-x64systemwindows
submitted
12-07-2023 01:20

Target

GI-Model-Importer-main/Guides/CN_UsageInstructions.md
Size

13KB
MD5

b3c38a16a3d2f38fd85dfe519f256c76
SHA1

3a974d889edb75a2f8848525a961f4ca32698d7c
SHA256

a68137bc59a4d6f4ba26c845856c8ce91a9be330325c5fa5311e315351dc571a
SHA512

b3e7f2f78c536eb5feee5423166560ca20820d23e7d95d940bae09e27f2c63968aa25605aaefd41b4f827a7f0b2f0487d46c3bb18bedc66f7b84dba5851a760e
SSDEEP

384:DDCQjz9Q37WfGfpeHNFgTkHRoR/Ju8e5Qj0j4aF04iIyRVinHb+:DD5Q3EGfpet1yxu8q+0UrIyRwnH6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3004	2368	cmd.exe	30
PID 2368 wrote to memory of 3004	2368	cmd.exe	30
PID 2368 wrote to memory of 3004	2368	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GI-Model-Importer-main\Guides\CN_UsageInstructions.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GI-Model-Importer-main\Guides\CN_UsageInstructions.md
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact