d54ee360c6838a535da9d19e9ea2a3fe1dce91e2720c7d46a4add02ad473a0e9

Analysis

max time kernel
1367s
max time network
1155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 11:20

Target

Awesome-Hacking-master/contributing.md
Size

1KB
MD5

20575e1b18a52276d6d3bbf06368d710
SHA1

053d20508d5fadccccc605f867f50c78b6ab9800
SHA256

90fb14c19e433725152c731d642cc96a44f05143f522374784aaa8ba0f174597
SHA512

a4a294188a4fbb554151e4863492c26f48b155fc584639319ac9536ddd13737b16bcb03bf7764e8dc2c4c71a23f8e08a8d9a630e5f5ad64fe8ef2537666d393a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1492	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Awesome-Hacking-master\contributing.md
1⤵
- Modifies registry class
PID:4568

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact