eb19dd67fdae4ca09fd29f17308a4fb82a29d314b7e067bc5d4119e8b1ae914f

Analysis

max time kernel
192s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 16:37

Target

AIMi - AI Aimbot/models/yolov3-tiny.weights
Size

33.8MB
MD5

3bcd6b390912c18924b46b26a9e7ff53
SHA1

40f3c11883bef62fd850213bc14266632ed4414f
SHA256

dccea06f59b781ec1234ddf8d1e94b9519a97f4245748a7d4db75d5b7080a42c
SHA512

981a56459515f727bb7b3d3341b95f4117499b6726eab2798e1c3e524de1ee8ed0d954c11b27bbbb926da2cc955526a194eddf69c55d65923994ab2e8af07042
SSDEEP

786432:p/DvlLLSMf8CJToqJH1F6Vq+43HfED3mtgPMr9uQD3sJ1nr3C3BEorWiA2UClq4a:p/DdvS2JToqN36AmD3m+PMQ4sJg3efiw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\models\yolov3-tiny.weights"
1⤵
- Modifies registry class
PID:4128

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact