6432c9cb0eac5654c6c0cd987298e294b1413e22f7eb2a4a1a06c5ec7566e35e

Analysis

max time kernel
89s
max time network
83s
platform
windows7_x64
resource
win7-20230703-es
resource tags

arch:x64arch:x86image:win7-20230703-eslocale:es-esos:windows7-x64systemwindows
submitted
12-07-2023 01:20

Target

GI-Model-Importer-main/.gitmodules
Size

104B
MD5

cbc2e704cfba3ec870a2fbe9ec1d1c93
SHA1

825a973ea73f4816f92d375d966c84892332aa50
SHA256

f03a0cc3c43a0a6795a68b9e353436b34977bee7b334b3125412e4d4a2d68ebe
SHA512

78fcbbf7bb2919e05244c4aacfcb0ae7a7bdbf9860063fe49d5a493905f0a992a5f422b93928a5ed25a3f69f2780ab92ed6ff55f1d8483731eacd783470bf1b4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2180	2816	cmd.exe	30
PID 2816 wrote to memory of 2180	2816	cmd.exe	30
PID 2816 wrote to memory of 2180	2816	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GI-Model-Importer-main\.gitmodules
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GI-Model-Importer-main\.gitmodules
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2180

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact