3cb27dfceb8b48a75b7cba0886ab9d7696057dd1186298114d7f5af9b497a0b5

Analysis

max time kernel
127s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17-07-2024 10:48

Target

Resource/AboutBox.bmp
Size

261KB
MD5

8d54f93d237afeac0f9a1f38419ec778
SHA1

d46781264b4d056fa2180ac4c8e514c192e6f813
SHA256

9f41ccadf3e51aeacb40aca9bf0a37a8f81cb5240e5d9d35bbfd85857125f0af
SHA512

a8c5fa1686bc508a417fda165c7dde3c09a9b1e12256be2b29d86f90373ac6221c3b05244687de0b6795555f508061db38f1bcfe7d96fca8b7c3dfd579b92f2d
SSDEEP

1536:BQSNjG0phPqY54aUmMgNNjepTcr9H5GRyptiM7s:SSNsqNNjPGRn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1916	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Resource\AboutBox.bmp
1⤵
- Modifies registry class
PID:1980

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact