30bb9d26bde1c90358969baa3097a8f8d84cf5dc62531af587dff8d54de60673

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 18:54

Target

devtools_resources.pak
Size

4.4MB
MD5

901e09ca208c8aa98e80e9376d6858bd
SHA1

e39fee4be13d93b75497952265f5c2820dca24cd
SHA256

f2a5e52b9fe750df8037c045786d2a87a9ba4f3620307a4b81a35741dab24919
SHA512

e25cff9690aee25f5b708015afafa1168f22d435f03172c12ec816fa1aaf2a31fcd82abe5e8a404bfe32b89ad075d209cf301e503f294e8f1b1538f6a5b2dde5
SSDEEP

49152:Vx0FOT5N11N9CryyB1VyeV1m6K1ICI/tYFPKGx0F4Rysx0FExx0FaDxa4WOiH5N1:t9z1N9y

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2516	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\devtools_resources.pak
1⤵
- Modifies registry class
PID:4628

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact