b20b682bccf264fb5cafa0f9379f597e5786aecdd17a7064f5ed4f4cd7a10924

Analysis

max time kernel
121s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 15:53

Target

Temp-Spoofer-Lifetime-main/imgui/imstb_textedit.h
Size

53KB
MD5

1310a7c1c1617ac4995b1e90e3b1a32c
SHA1

6d31e57ec3234d12618cca5164037f84246041f4
SHA256

686a603897d8ff024fd7dbc4bfe582ebb66b4581b89b084d69f899a9076847d2
SHA512

a100593b9c71d32dec8bdfaaf1a66265802627e58262f3ff7e73c2b161d3b9f4bdb059c80d827b6c9aac3801c9340139639e5179ddb9dd3c414778a3470726fe
SSDEEP

768:Ne34mnOxj8ZPNP6Mg+jkFmUfXWMn3MMl8cR8OsaLn5IM6MLLUYgG:0oWxuvLUYgG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Temp-Spoofer-Lifetime-main\imgui\imstb_textedit.h
1⤵
- Modifies registry class
PID:1492

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact