e3596428cd648a2b0374346a990e71cf4af0feb6bb6ec51d8ec3e369f26e2bbe

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 17:46

Target

geode/resources/geode.loader/mdFontMono-uhd.fnt
Size

8KB
MD5

03d291216c218b349deb503534b6ddd3
SHA1

2963dbc6e8ebcef1d59cbd0e80a750c0d2bf31d0
SHA256

5d56ef0ddd3e1837f8baf1c031155c1a04911da6650bdf5584eb60d3fda30e9f
SHA512

7a100292cd5752fb226ab36505bbab88f35d81ea94b1e1e90540ea3c341f691a0c46c913ac8fdbe814c55f9c175e2c4ec72f53718b4cce8a110608dac94a25e5
SSDEEP

192:2+EQCegiukz5CpEtAC1CtGkr5JQk9Vs06Y1CjieYICTI9r5J398h+Bu3ZEoQJgVf:OsB6CK

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3332	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\geode\resources\geode.loader\mdFontMono-uhd.fnt
1⤵
- Modifies registry class
PID:1236

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact