94afd6763dc6a7e3665dae43b5e33db6c79f640ee82987e2fe11aabe6c77e943

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:18

Target

NextLimit/RealFlow/res/description/odaemonattractor.h
Size

1KB
MD5

08820d5ac02b5aec3449d4f9e0bba046
SHA1

212b0cfb779173db385862aad333d53efceb743f
SHA256

466118fae9b98db4537f0374d5754b4e18170b254ec4a39bfd73bbc15520f10b
SHA512

9b3192aac4051948d86f1b40499644140f55eb02fa1a909629946933ab6dfa1446b166cd4b07ade75aa79e1d0719dcb222c498360894a13db7bf770b02bf60ae

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3416	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NextLimit\RealFlow\res\description\odaemonattractor.h
1⤵
- Modifies registry class
PID:1420

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact