0ae587f12695ccafab2f0328dffa444e6208ecad24e8840a5928911e5414ab36

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 19:52

Target

Walecz Ghost 0.50/Memory.pdb
Size

22KB
MD5

328b6699219813c52e5ee13e0592b2b2
SHA1

8dffe5b9c0270a8b7a209a01f49babe43fd20a4e
SHA256

8c6ef4dd3a69399cb79b60ffe7402ae9aac50f4828a2abe209805706e4ca96b0
SHA512

db378947623d09c7f86ca469905dc1deed1ad2d60d493c66a31f653ad9be93a90c75605251b4be23b80967c458f9d1a70bb2c8a4f614eb10bfd947a403a85571
SSDEEP

384:F419hSvw7n5BbNJ3WaDbAafx1R9JYlVBg4eHFt3eR0QNXLwfqqaP+ToJx9RIyQXZ:F7w75BJtZDM1qaP+ToJnRtRYua

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
64	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Walecz Ghost 0.50\Memory.pdb"
1⤵
- Modifies registry class
PID:564

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact