4793acf4ba0aa6c6d9139caf8ffa2d7553d6870a8980d51df5bc11e3ff9c8531

Analysis

max time kernel
66s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 19:20

Target

apps/slippi-wiiconf/boot.dol
Size

1.6MB
MD5

28afb3319ca48a7ff739a7c563f21573
SHA1

be9c66d48f51f5c3a7cca3be533b661aa4a56532
SHA256

fd6fcc4cb1a532c41b588643b5ce2895fa73a757e5cec094c12b9009a0c93c78
SHA512

2b07af2cdd46827e49ddb449e429216772b40723a49413708ca114c6f3e052485b564939e0d343638bb1703297464d892ff9c9ff0eb4971bcf570a1a27d61d05
SSDEEP

24576:pjX2tEiL5+0QBtNgMSzwfTrgWVV9jEdZpTS5rlux:lX2tEiFiKwfTrn9jEBTS5pux

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\apps\slippi-wiiconf\boot.dol
1⤵
- Modifies registry class
PID:3012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact