b7111d51e5a77bca18ad278cee2b990937ab9e23d58b60f7d6f16093a0971906

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 15:16

Target

dheater-0.4.3/.coveragerc
Size

171B
MD5

ec9da99c3924deb4968c87e114ddef4d
SHA1

954812d1afe235288cba96bf1244b917392e42db
SHA256

0456401b4d2e8fdbdbaa1154ee737fe78b96451cf787e57c2fd4743b3d667632
SHA512

bcdda446dcb572501902c7b133b70063acc82edf2f756534236dac2f1d2810755ac37ef30395acdccbe31025a4fbe30dbb89c2f5b8833bb6c68a694a16995ee2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3716	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\.coveragerc
1⤵
- Modifies registry class
PID:64

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact