c3d118812e55bc5a51eeb6c4c254abc744b3b7e58450212a153bbc2c8af196c8

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 22:13

Target

KeyViewer.pdb
Size

145KB
MD5

31e4181f42b1000d23f1b05a8ce1870e
SHA1

f7b027296ea2a15df3af4df2a7915ba47a73a17e
SHA256

935de74bc9fb2f290460b70c0d7351a9f0f1ffe2a04283ce7bebdf50d5197465
SHA512

82ccfe52fd102999bbe71ebe06413651098b6a91258753cd6ad78c22310918585e987a9704eba0c7073bb8715a53702d15f57a65f5895c24231b665c0a3303d2
SSDEEP

768:L+BQBNVTCc5j/p3AVvgT5wtJFxbK1Fdkkasa+zixEKBfN5I8eApZJ6o1qG/a+tjD:++zGHXI9A96/G/akjQ+2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3592	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\KeyViewer.pdb
1⤵
- Modifies registry class
PID:1732

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact