f729da1b785ba97da088626e8fccf9326972668d4e1dc4dad7b59d4d184e9462

Analysis

max time kernel
1370s
max time network
1156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 11:46

Target

isttool.pdb
Size

173KB
MD5

3846167e9cbf18daf3e9a45488cf757c
SHA1

be6d701b8487e7107560977c3d057290a0fb48ee
SHA256

84747066736f738afc54d607bd6ae3dcdd559ac8b713107c8241992e9947f4b4
SHA512

5c609e3a1bf350b0e31ca6b940d2f0b454fe6c0f045cc34555cf53d47d1fbd3208b1f86d662f7fc30eb2fbc73ec8329a20e6bd6055fb5c4f233c35da3220c250
SSDEEP

1536:hLKORan3AZAUOzJdRyjUOeMADKz6P3N8UpmgrSS4NVFDwzU6hQyXFa:Q3Lz9yte3KeCtfSMVFUzUf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\isttool.pdb
1⤵
- Modifies registry class
PID:1856

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact