57afc09e77a9fccab0dd92a7d5aea8cb86f3a7847fe64fe746e8be836881202a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 01:57

Target

AC-June-5561.mpp
Size

259KB
MD5

857ec2a2fa4dc1452b31ea7dcece2345
SHA1

116ac7079d2b8eca4fc5d53163c80fbe37ded677
SHA256

9daedcd5b4bfa87e8142de5bf83823af0822f3d21036f8cc6b8e236a55c2fd9f
SHA512

69c127e207036741442e66359483c7569cfce4eb2dd1db85f3f3a2bcc6c3e1d9582dd39e73715c88ab276aaf71dd71a0b34e39ddd90a3a90855cb806f6cbe66a
SSDEEP

1536:0KmRXMXBth38LkLZz8i67MV7VijGN9IKAwUFYhMwUFYPUjPaS9VKH:0K0KZ3Nh0ANdAwUFIMwUF+SPaS9VK

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AC-June-5561.mpp
1⤵
- Modifies registry class
PID:4084

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact