ef0250d8bd2afdd636bcdca3e55d135c15f18d1c18cad6502e1e58f352ad09cf

Analysis

max time kernel
131s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09/06/2024, 22:02

Target

bin/SilverBulletPro.Core.pdb
Size

483KB
MD5

51fc08b3bd94c2ceb5bcc23fd6647920
SHA1

b7df9dcf42e9cd1972a04dbf41415b52c939d114
SHA256

ea3a3391fb4cc55e57f251dfe88086dd59173a40394fa6d2ffafbd968f3c768a
SHA512

b4da86f008bcc3c9bce2ee7e27daab4cb0f82c240aa7dc922ff8de1b448ba9e27b56f47447527a614feb48c46442d270bf57735d2894576a39850e0734ee0639
SSDEEP

6144:ycnJ/QwSAuIj/ulKYV/YVBEWxgIuhpxH50QedHeSMhNMRevxiUUUneoICLoK/c5r:9/fzuOulK2kEWwhqFUel6wlnfv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin\SilverBulletPro.Core.pdb
1⤵
- Modifies registry class
PID:4132

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact