fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2023, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tf2hud-editor/JSON/zeeshud.json
Size

25KB
MD5

fee9d7a4d9b75443216b60364cd84406
SHA1

2e0307b2b4145afe5c44b933143539cf5b134de4
SHA256

36431a03caf416f71b4a2b7c6d09a08c44647afe4aec646a2796ba06e62e89d0
SHA512

afa95945aafd196f8295fc57be95f5f8451e851ad1e3dbb02090e8bfdc4dd7b4e1b24ee44703c2ada3d9879eef13847ce03a99528cb57f30d0af575d8255fa2e
SSDEEP

192:WiJYs1dFlorULYhu80Me0z0VN0w0+M0Q0/E0x0x60J0hF0G0Ad000aP09z0Sts0A:31FPkP87aAhBqjnpnrNuLN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1864	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\zeeshud.json
1⤵
- Modifies registry class
PID:928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...