5abe438c09ba63738adee8c49af3571dc3f6146877aff4ff21377f13f386ed1a

Analysis

max time kernel
139s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 21:08

Target
Android/obb/com.firsttouchgames.dls3/main.111.com.firsttouchgames.dls3.obb
Size 294.0MB
Sample240525-zy2f4sba22
SHA256 daf0425a9f2d7d68fb52875694dcb68743a4e2fa92faa76b0d515c3580215f70
MD5 8f89e7cbe7170c617b323457f76feec1
SHA1 58e54d7d5bcf36ceb36199f9be143cce1ae4d4eb
SHA512 af97c06dcd62f9f8f2d1b479abc7bdfdb5daa8260345fe03897d5f70cbe70fc7299971d20e20d8f72cf5d5b5e133b6550c10371f4354f7ea82cb61b3124fe3f1
SSDEEP 6291456:E/7Z/LO0CBfvsEJFbz03SuQ1Q7rNvTi7zWuTQYB9eT8C5dEiGfAhjLYXmzvqYRGj:uStBfUEJFn0lm3WuTQYy8waiGf8jLMYc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
320	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Android\obb\com.firsttouchgames.dls3\main.111.com.firsttouchgames.dls3.obb
1⤵
- Modifies registry class
PID:2648

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact