e746f10a245a5cb3d8bf010dfa30e7de6430e1f248e88d9acbb88596d01c53be

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 19:49

Target

Chimera-1.4/configs.py
Size

647B
MD5

8ddd3e095c17ced0e5e5ec2ab92a76ab
SHA1

ede7764ef9be2c79a97305817a90a677dae4e88e
SHA256

ef3d902ff82b50e5dca266a29418de9cf43e2a048b8294cfc114e3bc5c3c5ff8
SHA512

ab195088aead07554672557305a3b9889b425a1cab69d82e5882e6612cee1747c12a27d05b560e8820d68a8ae0817f11f9d0aefff230197aa7bb36cd20cfd359

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1520	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\configs.py
1⤵
- Modifies registry class
PID:636

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact