fbae68a26f20150a540f528586f8bd47e5eadac3b111995da5e77746305f145d

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2023 18:20

Target

tf2hud-editor/JSON/Shared/controls.json
Size

9KB
MD5

f511ecf46108804754ad2f3ef19c89d9
SHA1

e567c6e70e499e16e0ad17b18d109fbc59531c42
SHA256

72f78631af52a631832387ebc1ef1017962aeea1d7a16f10552891e7f4674011
SHA512

4887d0a47fb1fd9867d1c28f89775a85de6d9e540c79b2b9c2eb7ec5a39e477a4fd9c32f5f0ef8ce8ec4d3d16e1ad17d5eaa84715a370edee010afbd6db82f22
SSDEEP

192:GhunmVmV9a2dp2Zwk1etgBqOZxTPAWe7nClCdalZtlt/lU6lC/lyPSEw0mts8ml:Tx4ZMmVDDj8CCa5TJoM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1612	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tf2hud-editor\JSON\Shared\controls.json
1⤵
- Modifies registry class
PID:5052

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact