ef0250d8bd2afdd636bcdca3e55d135c15f18d1c18cad6502e1e58f352ad09cf

Analysis

max time kernel
70s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09/06/2024, 22:02

Target

bin/SilverBulletPro.CLI.pdb
Size

19KB
MD5

8cd537a5653513b676b7233518f354fc
SHA1

67b2495283d17f916d950d932c8ac64994f97af5
SHA256

44334dbebde5d6b7ec77129b589e02ca15e79d9cb772cd30dc331fa76d43d9bd
SHA512

43eb651cdfe332168053890bd3d5bb6144525091ad663290341e4af35f34eac283f170073e08b11317be816cfce3d4a680bed5c7ac07512b0638e2d00557b49d
SSDEEP

384:nh+CRA39dbl9Yp881sX+A60a09v2osSLL5F7fIHZElj1mwAbrB1JMglncpXrfH8/:nECRWlf8lYpJ2brB1SglcDE9t

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
228	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin\SilverBulletPro.CLI.pdb
1⤵
- Modifies registry class
PID:4440

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact