3c45979aef4bdaaba83853309200c1cda6f09e9ac4d8bcdeb196fbec0aab3b34

Analysis

max time kernel
454s
max time network
457s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
21/02/2024, 02:12

Target

UserBenchmark/App/F_ConfinementCS.cso
Size

2KB
MD5

41f55848470a149029de02facdbfa348
SHA1

054a82d0230dc15c9f531048ed81175c0b028236
SHA256

6416746a7d441b8c91a45a21773f97a6d8bb175da6e43c2d753e0bfaf9c97997
SHA512

5a4e2e0009857aca3ea81d390b52c9b06c00dd4aeafc91561fa00532e0b264caaee3e7dded517000dcf43652e101fb3927103665c9d80b2f4d21e98172b32ed6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-664403437-228026989-2547995067-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-664403437-228026989-2547995067-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UserBenchmark\App\F_ConfinementCS.cso
1⤵
- Modifies registry class
PID:4392

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact