ff9db7e7ac4a269f9251794050f01ce16ca76229a48322f4cba15816812ecf7e

Analysis

max time kernel
10s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
17/06/2024, 11:37

Target

inuria-cracked-cs2.pyc
Size

27KB
MD5

595103b15ac8d2201bec79907d33a3e2
SHA1

03b0284e005909d0ded539a1ab1a2f7f1a0051f7
SHA256

a4f7f76418bb6030a9d5b0d903b01870a5a978a516949a9b08124a56c851d32a
SHA512

c1c061a57fd0b2df41ec7089a04e00aa29b994b0f030f2b960bb60819f6dd1a6081e373a2958b36d1a2345cae40576ce427ce5f2892880c1812c948e9d912a26
SSDEEP

768:f9rTYXnqdnNXslRKl/Tvs/6RF93t/If+Z1jUCi2UDk:f9fpNclw7vsyRFd9E+Z1jUY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3368	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\inuria-cracked-cs2.pyc
1⤵
- Modifies registry class
PID:2936

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact