f4cf5cacb7dea6b4d02ec71003b99c42e454defaa4e000b24475230d181a51af

Analysis

max time kernel
1173s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:53

Target

MultiMC/translations/mmc_es_UY.qm
Size

166KB
MD5

acb7e9319ff2cf322988d6931c9bc93a
SHA1

199fea3145d966fee3e552477c52312163e1c8fc
SHA256

8356bca2d40ba2d6694b50b770de532cce6280cb23d88e62613df955d04943bb
SHA512

a63a2a923b89ad073c84c6605b107a375e23ca0313877054bda322d00efdb58526c0dad0fe474076a4100802664f00948c6640723505c8396e0a57378ef46900
SSDEEP

3072:z1UHqfTXswAECpaUGkXrwfDYC6dEI9YKpL8V08xRBbsUjlevuiVdHFjiAVY1kkBl:zaRole4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2336	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MultiMC\translations\mmc_es_UY.qm
1⤵
- Modifies registry class
PID:6028

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact