a8d5126a1eafba06775bf2eaaf74b52873f15ac8c35a3603517511fcc6e1eaea

Analysis

max time kernel
397s
max time network
1167s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 20:06

Target

locales/pt-BR.pak
Size

510KB
MD5

5ba65ef5d3afb467dc5387f9ab0bfa96
SHA1

006e0aa5e7e5f69bffc3bb8ca5371a97db2feed8
SHA256

fca071050c9a032d2fcc4457c6b6ecf38406ffaa18e4f86aeb59359749051e35
SHA512

63d5df218da9ec91cc69b84c7a1a0b96a8863a8f3a32a97e29cad8130dfac9612e827170e5fc01940e674bd413f270425130d09247657166b80404264cdab06a
SSDEEP

6144:Pq0jS659iO1NBXBLXwEXlyEo5DTJS0qwsRQk9kp:Ld5UOo53JzsRB9W

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\pt-BR.pak
1⤵
- Modifies registry class
PID:2336

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact