64e87032c830ebab767e08f466665da630b1f2cb0c6b79be0bb0aa44b7bfd555

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 11:52

Target

docs/.ds_store
Size

6KB
MD5

4d649b16340219c4a60e3727261307cc
SHA1

fbeea5d43113f0fc2472802b851b249e943e35c6
SHA256

24296f732cc6696273cd6b23a3e27a32932836993d917bfd6f843b525d3b613f
SHA512

94ee5502d514090af45e7e3f5794ee33e09ef2421b5da969a626e9fc18472aa96e729ff07d4ce97613696209d62fd3e42984917f922c80c92a6eed6df15bfc33
SSDEEP

12:Qi11luVsOzOl639EEX/HnXw6XAERqXw6X:f11luV1zOcdfnVMV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\docs\.ds_store
1⤵
- Modifies registry class
PID:1056

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact