c37a5bd22e9a2565e57e81ce8d97a8d6aa17633ad819607f34ea924d00f9944e

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 17:56

Target

00113722_XP_Vista_7/data1.hdr
Size

27KB
MD5

ab1ce2337b3c1be58e065d07b6eed4c2
SHA1

587028ceccc39daae2da1bf84b8a35fe7b0953d3
SHA256

c123ad21120605c4296f614c6acce9ff8e0ae464034dc011f11b7f608e79af08
SHA512

6bbc3ba895f47268f958ae92122d1a33155448fd08592fbd30af57bdd0afbf80e0cb0515e4bbb3b3e6618de05e552a82c1e0990d641b2b7bb0412a9eea83bda5
SSDEEP

384:KzgHXHyBRMUsG9nWg4qkap9s1wuM5rVMEjv54Q474o5xcY:FHXWwHo9iwu4rjR4Q474o5xcY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\00113722_XP_Vista_7\data1.hdr
1⤵
- Modifies registry class
PID:2436

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact