ef0250d8bd2afdd636bcdca3e55d135c15f18d1c18cad6502e1e58f352ad09cf

Analysis

max time kernel
138s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09-06-2024 22:02

Target

bin/SilverBulletPro.PluginFramework.pdb
Size

11KB
MD5

50340d0cfa66909f9710131e42665331
SHA1

45bba43968404783f5ad8558727af8a550741504
SHA256

b93b82f6ef283ffbbf79b96e2e9d14958f22f7ecb3c23e5f904933a629c55b77
SHA512

dbb089855ff34fde5262443ae49bb979bac3d713abd673e456663d3f119e1b34835ad5d18a09a881f4d190b38cf412b51860206634bbb319d227757d09b4f177
SSDEEP

192:37s5c5MZ0ONIkMVru9Fs+Z53WaDbAafx1RQaJYCoVBg4qvHFtXH61R0QaYP9NleZ:37sy5/FDV6/F3WaDbAafx1R9JYlVBg4U

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin\SilverBulletPro.PluginFramework.pdb
1⤵
- Modifies registry class
PID:3148

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact