5daea0e236791d060252b4e08b7c5e287d448891187ea0ca2b802e4ea1af9834

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 12:19

Target

x64/Templates/ConfigComplementos.rpt
Size

64KB
MD5

f5e0f49448c961d00f5e1fb5ababaf60
SHA1

9683c793075368ecf3575d8d4e4571be1a021b1d
SHA256

3f95f256b75c853ff5fa9b5133903d6a7d99a0589b3fd72fb2f9e76dc672be82
SHA512

e8798587ed0964654a77d42c4e49f62d3f781c49a07728c7161ca59854f8428336a122b914926fd42138ac3f487c1990f996b785574a75c5da62394381e5177e
SSDEEP

192:lZ7LAfF3MwMlGM1M4MxM7MEZg7Bv4dOmYwcXBmwTEowvrM2mVhG2q+Xa0cWIQr:30SZg7J4oBwcXBvgoCY2m3S

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x64\Templates\ConfigComplementos.rpt
1⤵
- Modifies registry class
PID:5004

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact