3cb27dfceb8b48a75b7cba0886ab9d7696057dd1186298114d7f5af9b497a0b5

Analysis

max time kernel
147s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17-07-2024 10:48

Target

Resource/14.bmp
Size

132KB
MD5

22fcb3ea5ee2414880ef094b6b965c94
SHA1

dbfb1cbb08981fdd3878faf4179f5fddf67a4a9d
SHA256

9058e0d9ea998c21309757586d30b0e5378c0c1904ebc2d95bf01223ddba269c
SHA512

f104e05e5fff7ea1b5e7e983ed8185ee5fcb3d5affe07f9d60663b61027c4de76743b4b67d21578de7f35eca75d953a8182c7d3330c2ec65966cca6a4363c294
SSDEEP

768:TVDtEq8oBHHtrCOVPggBFxxwi5N6rcvyNvP24pTkgXN39OC6hk1J+BOUozzGLjYO:2QiqbJrGBO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
244	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Resource\14.bmp
1⤵
- Modifies registry class
PID:4884

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact