ef0250d8bd2afdd636bcdca3e55d135c15f18d1c18cad6502e1e58f352ad09cf

Analysis

max time kernel
137s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09/06/2024, 22:02

Target

runtimes/ios-armv7s/native/libMono.Unix.a
Size

554KB
MD5

2c5aa0548d45cb09886e582fa498de31
SHA1

4def6d75fe16bd18af9b74d67cc298bef04f7a9c
SHA256

28305b1cac899e5a495d717cea0e9d119d81506a77152bcf9db7970076cc9a8c
SHA512

076ddb7e79f9ce0c060c37ce3784d618cfa48eded18148cc7bfe6ea61f18b96236ecd08631b081adcd8477f55a42db288ad8ab0d72aacbdac4d6ff22073570ea
SSDEEP

6144:F3G1futh1PhBDrdlqcSaGvKyQRY2tbW/pUR8PDwTvQ7469F+nmqPjRh9QvonBq2X:e+79ecnepBpDwkTYaoBtbxD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
644	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\runtimes\ios-armv7s\native\libMono.Unix.a
1⤵
- Modifies registry class
PID:3128

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact