555d666b7b1044428d638a05a9f0ec3f60f24ae0e031095855c487417ff77b6c

Analysis

max time kernel
421s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 13:37

Target

Rise 6.1.25 beta fix/files/azul-1.8.9_345/lib/amd64/jvm.cfg
Size

1KB
MD5

c60e77ff5f3887c743971e73e6f0e0b1
SHA1

9b0cfd38ec5b7bd5bd1c364dee2e1b452a063c02
SHA256

23f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d
SHA512

07aca3de1a03a3b64b691fd41e35e6596760baf24c4f24e86fca87d2acf3a4814b17cd9751adc2dcd0689848f3d582fb3ee01d413e3a61d1d98397d72fe545e9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Rise 6.1.25 beta fix\files\azul-1.8.9_345\lib\amd64\jvm.cfg"
1⤵
- Modifies registry class
PID:4472

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact