ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
150s
max time network
166s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19-04-2024 12:40

Target

$PLUGINSDIR/select_bg.bmp
Size

59KB
MD5

ff051f124f5d85f23efd007c9ae2e465
SHA1

c6f0adbf30888e8ba5a6ade5dfb3d43e773f9a75
SHA256

4b1f2c35e4f53778cee78a84c64d0a44e3bf5c1a751ff8a66d16c47bb7e082eb
SHA512

523c864ec9eb6a289c65e5160b6eae3437500b950865398e841c05378a2497c5c7db31187e01b7295b12a49c47c18809908d5ceb55f5ba3043d81577c3b358f8
SSDEEP

6:5A/6BTZaRah8km8WpS4zo3BaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaaRaa4:5Ai3y8Wg4zoX4zoC8WMa0d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
476	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\select_bg.bmp
1⤵
- Modifies registry class
PID:2516

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact