1cb679bb9efcfa98fec65b5e9d85566f0d05d72aca93a9046298ac4d726f9653

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-es
resource tags

arch:x64arch:x86image:win10v2004-20240426-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11/06/2024, 17:43

Target

Aseprite-v1.3.6-trial/data/convmatr.def
Size

8KB
MD5

74390911df3f3fb041c62b50776ba3bd
SHA1

4a93f338e0f04558cb54c682e577ef63361a4350
SHA256

74620bcb67f860ffbb06a4125b2365c34d6bf6502423cd775e11021b352cecfe
SHA512

d87c5d3b2fd139b6fa8e276306bf4c7106fdc77570001bc684d5a043cf76c1b7a5ff6195d34472052b1e865bf5d3cce3234635ce54952abb4ee3ba63c767b5c7
SSDEEP

96:AmKK3ceAbuJ8oVyAbGzHxwOcRgRqYfCk8XkPpY:3M5pP2JisU8XkPpY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
580	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aseprite-v1.3.6-trial\data\convmatr.def
1⤵
- Modifies registry class
PID:760

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact