a693fff41c4e738cfa6b7f0e9bcf51ae341b276b81189fa698f0c0ede4a8a54e

Analysis

max time kernel
136s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 20:34

Target

Kiwi X/Kiwi X.exe.config
Size

1KB
MD5

1f48b296eae19f30d6abdd9e1fbc1a14
SHA1

8529346e5c926a9f4ded49320873f70ec6a7f9d0
SHA256

97ca967656db09e3d7046339e5c9e774c179a8d9d7bc72584eb5a8071871c2ec
SHA512

c69e5e0b82a27596bc5e2481d580fdd5588036eec6fc13de31e1dfdfe9a6b81882a69c43a3f3f2f145cf17a55cfb2ce4cd28c21291935fa13336a379f040a7ee

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2408	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Kiwi X.exe.config"
1⤵
- Modifies registry class
PID:644

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact