2f79a30540e3f31d86819c9fbf4d4f3a91d5d83ae07bcda94b1388818aebc933

Analysis

max time kernel
315s
max time network
1580s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
05-07-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Heaven's Exploits/Solara/workspace/CFA HUB/Battlegrounder_2_GPO.json
Size

103B
MD5

11a20fb3a36a44e6d84defc45e451137
SHA1

953db601c550347c22e4fc24686d18dc5bf55812
SHA256

5482c0ee2a7c556c1fbd2622e020c0df47e7d8d8e9ff4e2c6ae640fb90229ab4
SHA512

1413708671b5b8fe8f0a0cb2315790d71866436098d93e905296b69c432c6bf61d009ad2a365e2f3452612e2791ed135dc71695c40fc98c9b1a00b2bad3895b4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3868 OpenWith.exe

pid	process
3868	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Heaven's Exploits\Solara\workspace\CFA HUB\Battlegrounder_2_GPO.json"
1⤵
- Modifies registry class
PID:4156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads