2efceaf3abb2499b3f33f3d419f1805c14b7d85cdaa8cb032f0300c639ab25af

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 23:37

Target

[Boschiana] Fitness_ReviveLeggings.package
Size

2.3MB
MD5

97034bf575cb210829abd907d659c35a
SHA1

068690b20864a657901f61ed5f50b5ee2b3cf0d2
SHA256

2efceaf3abb2499b3f33f3d419f1805c14b7d85cdaa8cb032f0300c639ab25af
SHA512

91b56a16d3f6d8865dfe20692d85fcd7b2fedf5d6893d4885c9c3d9d1a7a835c17c81c2cb2e9686c5c881a7c8080af2fc1735849494f530b23f85f37279194be
SSDEEP

49152:9P/r72VOTGGfgv5px1XLUZi9AkbPKTQ6oH7jcFh4XyDdNGIIbaNzQhP/T1oEm:tzyVOTGGIBdgi0SHXWhEyDdnIbaNz+Vm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1440	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\[Boschiana] Fitness_ReviveLeggings.package"
1⤵
- Modifies registry class
PID:4836

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact