d54ee360c6838a535da9d19e9ea2a3fe1dce91e2720c7d46a4add02ad473a0e9

Analysis

max time kernel
1794s
max time network
1149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 11:20

Target

Awesome-Hacking-master/README.md
Size

12KB
MD5

18acf9024c48c2eeba3c397281500e61
SHA1

518ee7e4c9c384ecb7817b9f41521e2d88bc82de
SHA256

a7199cf0efd33aad9e50a8155decbe310462ec517712dc8d22174081176aa8ac
SHA512

f01e747010e1044a0e78df038d6809c853248e205fb55dd0c7f66efa3b519650ccf4b8dae35cc961d96675c14440b7499a4b42d971293cb5005b3cac717e26a7
SSDEEP

192:U5xvJq5J8MDm7V7vPAKJk45sHKuQxJphncg2CGd7GmtkcW6X:4Rq5JZm6bqcg2CGk+kWX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Awesome-Hacking-master\README.md
1⤵
- Modifies registry class
PID:4484

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact