56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:56

Target

$PLUGINSDIR/app-64.7z
Size

73.3MB
MD5

74c664e89ef71d4c3a8c2acb7f966f77
SHA1

423da23025d1a558b857695c9dc83161d9027841
SHA256

f61d9d8bf330c98ccc33e6c73ff38aafd9767a51e43258c35058fb96e4e3399d
SHA512

aa0ee334ead4629e317517b7112de6547caf96f27ed2f2c77a2aa97f65b7c3c4c6c0b3467a0e894d9753e071b38f69e3c8fbdc4411e6ddd1625359d06effa39b
SSDEEP

1572864:+QETnfgfbqT2V6mOKBBzx3k9wzdDvRPB15Oex/wt0cLi+nlUDAB:+QEzg2K6FiBz+GBTRJmgm0IiyB

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3288	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
1⤵
- Modifies registry class
PID:5036

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact