3c45979aef4bdaaba83853309200c1cda6f09e9ac4d8bcdeb196fbec0aab3b34

Analysis

max time kernel
445s
max time network
452s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
21/02/2024, 02:12

Target

UserBenchmark/App/F_BuoyancyCS.cso
Size

1KB
MD5

a5b967d4ffd6d5ce5e67496f031276cc
SHA1

86fe0a1fcaa31230132f122ce5d3ef0371693495
SHA256

59ef6b90c5189f78334bf1ffd6b470ce4a3fabaf49f17d7a8d8be7cbd13c7644
SHA512

26697c51c28259c7ca37f338d6c2ea0119258740a368d708070353b7425fdbfd2880fbaf41bc02e8c221af9af990225f8a5a252979e194b62fb6bd80b57afdd6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4964	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UserBenchmark\App\F_BuoyancyCS.cso
1⤵
- Modifies registry class
PID:4432

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact