ef0250d8bd2afdd636bcdca3e55d135c15f18d1c18cad6502e1e58f352ad09cf

Analysis

max time kernel
80s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09-06-2024 22:02

Target

runtimes/maccatalyst-arm64/native/libMono.Unix.a
Size

608KB
MD5

c27fdd02251d0d7ff4d84ce99ab404f6
SHA1

e5b4ab120b7667e21dc0f6bb820879129f8d5986
SHA256

a5e8b37e44b6c489f1e8ee30d18f44d1eb8183fd70b17ceef335b0356a547b77
SHA512

f2363033140541a62384498edda74cc13f690c7c94f114690de9dd851947ed69d7c78bfd637c6cd8cb68744a1bb9abe34d30851421bdad5c70a5e80fb1301d6e
SSDEEP

6144:PGaUI6xc939logTDByQmYEtRZKLc13zBVis1V1EwKm4wIwcxrTOCDajXi8kxc:ZzoX0zE+wIwcxa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\runtimes\maccatalyst-arm64\native\libMono.Unix.a
1⤵
- Modifies registry class
PID:4440

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact