9949c39270c5aa5ed2166a6928eaef1b841573226983c39022bade70cd7b328e

Analysis

max time kernel
139s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 22:07

Target

Cracked Serversides/MentalSHITSIDELOL.rbxm
Size

129KB
MD5

d99f0acfbb74142081c52d82d659fe43
SHA1

89c076059c3f59e8b5425508b82b7fbb8bf8ca2f
SHA256

2aba8701aab01a136c5e395ef0682c110956521e1f5b334e8177d4d55a5fbd28
SHA512

1518521dfbd62e8cbb66f1003b10b72909e975f3f5c23a0568191b423d737fe1b5181bf6ec24aacef7dfc4c472f15b172e453613a409b93bb4d88e82e7d8009f
SSDEEP

3072:6A6mflhDrMr6V8fgt4fY+YEaBRVydw3MfDciu8Vio:6AFtF+fUsjYEaBRsdeYDr

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3804	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Cracked Serversides\MentalSHITSIDELOL.rbxm"
1⤵
- Modifies registry class
PID:2648

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact