c3d118812e55bc5a51eeb6c4c254abc744b3b7e58450212a153bbc2c8af196c8

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 22:13

Target

GongSolutions.WPF.DragDrop.pdb
Size

189KB
MD5

80b0b7cb668a7cfc9ced7cbf1e000755
SHA1

0e07a5ba4253a9da0523345743c72e0daf01c2ab
SHA256

d35913b080306ed7f5f8676ea564c9712ac0c740b55d3d15bc158c6226963075
SHA512

830addbb2c07b20b7db149a9a4b864f825b47c521c7ccbc1a6d1522fde5727ec52c67322cc3a050671af3531cd9f02411a2191909793efed42bd00bb1899fa50
SSDEEP

1536:vgjHQxR8W5S0d6FtJRwzbKU/RJwV7wJzSkMIPGRjY5MIP6:bFRdbfjLa7woJIhyI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
820	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GongSolutions.WPF.DragDrop.pdb
1⤵
- Modifies registry class
PID:4924

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact