d88271eb4440a41f65cad7e1d6c8b6b5f5d627d2bba8783b7ca76890467e9947

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 17:54

Target

SmokeySpoofer-main/SmokeySpoofer/Auth.Designer.cs
Size

6KB
MD5

190d08c382668c0e5d7ed5d5c469c242
SHA1

3061a7ef6084e6f91f2ac16a4ada128c538224a6
SHA256

c97234a361e6a0f4b42a01e977ed6269b60629bee767f9ecbaed5c11af8f0e43
SHA512

330b5e7cd6d0f60bc4f1a9afa14a69be687495340fa04c5591cd9d76d8dee0c2b819a0a6aa1e09332d6ad878af5a6c14bd995683543a89d21b5ce7f4465421ff
SSDEEP

192:3wlZpSiVh2V9PE2JRCV4LBQCHJTV4GYG+E1JV4zqLOA8gsL94IYjY9:3wDESh2V9PE2zCV4tQGJTV4GYJE1JV4P

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2148	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SmokeySpoofer-main\SmokeySpoofer\Auth.Designer.cs
1⤵
- Modifies registry class
PID:4484

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact