d5584867088d27e1296f9cc4f01dad2011968d44ab03136392189efaf4f82411

Analysis

max time kernel
1s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2024, 06:53

Target

ThunderKitty-Built.exe
Size

9.5MB
MD5

07a731a4ccfd42b7921cea4e6c0fee99
SHA1

074fa2abc28ae584faf563b411ab593126a92dca
SHA256

d5584867088d27e1296f9cc4f01dad2011968d44ab03136392189efaf4f82411
SHA512

b278f86ed18994fd1d0f0fcadc32e1fa89c48db0954b2e7711ad64f845add88ea809fcf1296a5aae949331e238418f91d27b5575df90bb9a18be350a619b04f9
SSDEEP

98304:aQq04Meu5a3Vd/BgyQeYB6IEPjPEGmTCR:/4MeuamarMP

Score

1^/10

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3680	reg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3680	4052	ThunderKitty-Built.exe	79
PID 4052 wrote to memory of 3680	4052	ThunderKitty-Built.exe	79

C:\Users\Admin\AppData\Local\Temp\ThunderKitty-Built.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderKitty-Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\ControlSet001\Enum\USBSTOR
  2⤵
  - Modifies registry key
  PID:3680

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact