9127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 15:05

Target

salinewin-safety/salinewin/Release/salinewin.tlog/link.read.1.tlog
Size

4KB
MD5

9b902ee2880a7082c9edb68ceb898e56
SHA1

d2696bb8041d6144e03b62b95b2145e3ece984e6
SHA256

4561e6ad5ef844ae194f46b0aaa74788cfd18c3f985b441c0ea1067b6c1da944
SHA512

c465be0bcf8235c39aa77e38695d66c0844b704476ab99d81e2761e99ea1beb6e6ae10f047d0ccc41e174c4aec567d06d4da32fd757cf5c8fa3cc44084e9b5ad
SSDEEP

48:WoPAe7RrNwLd7OX7V7Xh7J7Jy7h7J7Z7OK7l72YxPxOJSSIJSSYJS1JSSLMW/ned:WoPAe7RrmLgzNSxP88MO7P1GqHS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4324	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\salinewin-safety\salinewin\Release\salinewin.tlog\link.read.1.tlog
1⤵
- Modifies registry class
PID:1600

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact