52a46e8d079ea9ed900f3784ded4406c3819e6e479ad7d5cac10073bb0fece31

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 06:16

Target

I18n/ja_JP/strings.mo
Size

31KB
MD5

2d91af00e4a20a893974fad7e22b7e0c
SHA1

4d25e44446ac106494118f7906e3b354eeaa8c77
SHA256

021055e8374beb632ec3e150119a360b0a979fed53d9e4b799efcf744ba3b692
SHA512

91195dbc72b7337407734c1ecc02e521db754beb16ceb2d143144a3e30bdebadb686fbbcc1fe3b44451bd05faa012a8c88100cb671f0ae8ae34a4cf72456347e
SSDEEP

768:bJtjeu7rK6a0Foxuh6e3308cvwHfWR4muM3agx7Yf:kV3uh6e337houM3lWf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\I18n\ja_JP\strings.mo
1⤵
- Modifies registry class
PID:3160

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact