d98106f7c16ab102f45e1b5cb476d7118f5959da62e2818f616c237149187939

Analysis

max time kernel
89s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19/06/2024, 14:16

Target

priest-allinone/PriEsTMobile_Android.apk
Size

845KB
MD5

d63145bc764831b4fe6fb35af4a889b2
SHA1

2d918aafd371a6a5059603352a8c85e6cca67db4
SHA256

6da9ceba1628e72fd7860236f44314b0dfef1baec06e63f92f69d0deb1bd0dcf
SHA512

266feec48e77226ec0ab79b1e28172b6db4ec892bc3577dabbb0e079c2bc36732ac6804542e7d8c82b93d8430deea3cfe4c1a09406ca757fcb84ef3e6c8baf4a
SSDEEP

24576:Yg9HZ7MeISq6XIG1zJ1YetkxRH/JF3jnuLd9nsaep:h957MeIZed1zHYBxT1uLfsN

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\priest-allinone\PriEsTMobile_Android.apk
1⤵
- Modifies registry class
PID:4372

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact