e8b27d9776228fec69909096f712fcbf90cd8a335394e3791ac3be7cb37b3556

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 17:04

Target

x86/updater.ini
Size

267B
MD5

6499b6ec03c720c897b9bbe4cada2647
SHA1

4b85d520ad8aa77c5df4cdc5b4b9669b205ff354
SHA256

edd1a68585ebac3872b7ab0a085b0a5c92f58f7dc59b926b6c647cc172f69ac4
SHA512

eda8e07e04ac8b1b300f907a10fe6294d8bcff16d7aecdc3da36be6efd29aeda022a0428f1a31837eea19202bd5e559f3f19c541b4aa22dfce313aed8f1a0d69

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3428	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x86\updater.ini
1⤵
- Modifies registry class
PID:2744

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact