ca26d7f34c6dfe421d5706c82fdfd737593bcd7f07dd712e28b32ad40392e3d2

Analysis

max time kernel
53s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 11:26

Target

TS2Prototype-WindowsNoEditor-TTpacks.pak
Size

32.9MB
MD5

708b0e32a02f8bd4e2d92704c9e5e8ee
SHA1

b6b715cc0f7308b6a7c01c68b2bf1b0d1c6e5ba1
SHA256

e6d548b8bdd92e6037d678746fa044272b6d24caa408a2959fa35fe1bf6bcbdb
SHA512

e3239d4af145fda25f7396383515ea020b1076c6c1c393695446c47df57112ce0ac848b1daf38a62b32ecb9b922999d9bcbae64d634f6059c3842bb99febfeb5
SSDEEP

786432:wKFddBaIk2SN+SjeaRjp7+UqSh+2gqb2zj9VFszgirn8SO:ldB7tSNTjTRNrhOqb2/9VFegi4D

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
436	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TS2Prototype-WindowsNoEditor-TTpacks.pak
1⤵
- Modifies registry class
PID:3280

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact