bbcc6444202f68e4154063fe28d7a5bd1dde6de140b7e80d707060bb7dbe1650

Analysis

max time kernel
112s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 12:59

Target

Among Us v2022.12.14i-Pivigames.blog/Among Us_Data/StreamingAssets/aa/Itch/StandaloneWindows/initialcosmetics_assets_all.bundle
Size

139.6MB
MD5

1ca68974e668f5a48df78ddaaddfdd87
SHA1

5156557f71330bcbdc221cd07862b3159dfab536
SHA256

3662c9df523e3bca0bfa26022f8f430b6b9b7398bd76c986b2e28de3b22b05f1
SHA512

5660bd8cc639f932cad3e964af80e7780ee7de0e29513fbf0bc6b12fdfd1d4804fcc44335b85766f2e486f62645c019a100ce43e0ee04cb43bc96e3b8b12d41a
SSDEEP

1572864:AaXdgQa1xzoVGaZJkF7nNVYpOeZ0AHBh05+3Is18yqChKylf:AudEUVnJkF7NVMqAHB+wIpyqChKq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4780	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Among Us v2022.12.14i-Pivigames.blog\Among Us_Data\StreamingAssets\aa\Itch\StandaloneWindows\initialcosmetics_assets_all.bundle"
1⤵
- Modifies registry class
PID:3424

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact