e501bb0f2315d61eddbe2d93bc7a31cb63098ed4e7aad3adb2e46fa089756460

Analysis

max time kernel
94s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 14:00

Target

OURTanks_setup/util/options/__pycache__/token_checker.cpython-312.pyc
Size

4KB
MD5

d2e05ef232dd57c7a4a1cb68945626b7
SHA1

74e0e8be8324e6514af5258f8a120e8adf216bb2
SHA256

cfc94bcb6ed63782a76c686c22d7afe19906fb30145cc0f73bfa53b97f9f4286
SHA512

bff05b0569893b8a460e20f7df6a5fa049849347b5e6a0d5b91e77560a31deafee86ff757f873d20935cc78ab82dd004acfae715f2be3c213d102f31a956a21d
SSDEEP

48:0SLu0U/5ARe/Y3dBdwf8KDhIEjPRIdfEb+n7HEqh5PNA659GPwt5fSJYaJL2TOhx:RuLse/Cb+pJJ/Cn7kqVjLfP+SqhsG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OURTanks_setup\util\options\__pycache__\token_checker.cpython-312.pyc
1⤵
- Modifies registry class
PID:4956

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact