2dbf27909ae942e4750db2a186e7548b37919fe638f82cddca7e95b29fb847f0

Analysis

max time kernel
141s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:23

Target

Lossless.Scaling.v2.8.2/Lossless Scaling/LosslessScaling.pdb
Size

38KB
MD5

24dc87779bcd6c5990fda64961a0ae48
SHA1

337bbff2d2c008258a450a30acf22fe7485664d0
SHA256

5535db37dcc58f02abe44c5ec9ed7399b692ff82a4768125821f72a4920a9405
SHA512

04f7c735126b38eb0a080f443b8b99c3d27434c051fe4ffb1850f4be78d85c62f6ff0926bc2aefb96b0f7fdbd9aeee0088b8ac05590198ba1fb7d979c274c18f
SSDEEP

768:fTRMDIjvTfKpipRGLGHJv2vDnn78dLVnEoCPbnG:f++vTJGWOvDn78NxCP6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lossless.Scaling.v2.8.2\Lossless Scaling\LosslessScaling.pdb"
1⤵
- Modifies registry class
PID:4200

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact