ceff46da586622eec2d85705082b12ae8af0e9cde91f573b8aa2d6edefd7207c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 04:48

Target

x - Ware src/Uptime/Frozen/Plugin.cs
Size

1KB
MD5

57cdd223f461b0e7d42bb70ea493df09
SHA1

9d31f8d3b8c69f4f40f5f6f20e214abd9ba5301b
SHA256

25207864c7d5711506468327b56d0bccee267e30f2192928968db7336ce25f0b
SHA512

4e63a8eafd66d13105202551040f8c356fbb174990a22318388ed9f521fab709b6a7d2d981aea308509a847b2ffa2d169639d494c1923218da3d08ec2d6b4b92

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3180	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\x - Ware src\Uptime\Frozen\Plugin.cs"
1⤵
- Modifies registry class
PID:1964

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact