4c5e98faa2966ae508c9b5279e2dd4e347f8157bad97802e04c7cb4e0b6a3a02

Analysis

max time kernel
442s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 18:15

Target

locales/de.pak
Size

137KB
MD5

a2f76deb231427db252713b1d370a2c2
SHA1

e15c9245e8f1a50d1ed0d7aa61bf22bf9e668d37
SHA256

d853202c9d590fa88ff7c2adc57917ca01e829b4f87d803d3be6a0dbc09d3af6
SHA512

67a293c5109ba729cc7833b08aabf5e464e54ac65e286137d228c76c407e81b733a01f5be6cb770c57bad539e7a0807fde7abf880004cda8b497a882e07753a8
SSDEEP

3072:lalMp2ob23Yp8tMoAq/AJ/vN5N4+lOgxjl+:lalMctMBB4bgVg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4160	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\de.pak
1⤵
- Modifies registry class
PID:2820

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact