4ce154cc8c0d952cd7364d9f295b37bb9fdf4efbed369464bbf95ba97cc7bf5d

Analysis

max time kernel
439s
max time network
446s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:09

Target

Office Tool/files/preferences/en-us/settings-access-en.json
Size

49KB
MD5

65b2795c28bf525ceeb37c9da2dc388e
SHA1

e0a9a1c3c23b92a9600ee6f398e4ec6d9adb077b
SHA256

7e6be73436127bb8e28dc0c16dce2e25d6e4d98450fc447b70065d290dfe7ad2
SHA512

637aa0081c4bf724164fbfe528514a9eb2724e49c1f0fa701158f48adae3b0c801b7298f215b3a6189273051959b338f6c5f16e46e5d35556353cb90b2beafe7
SSDEEP

1536:jFtp8ROzdhZMP9jcNwhOPeZXQKRzIz+VC:xCzdIzoC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1264	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Office Tool\files\preferences\en-us\settings-access-en.json"
1⤵
- Modifies registry class
PID:1376

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact