dd8ddd975105d7c9766b165c1c8dc9bd863b08d26acd1f06f70c5cb032a79e7d

Analysis

max time kernel
1565s
max time network
1536s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
01-08-2024 20:40

Target

qemu-9.1.0-rc0/roms/opensbi/scripts/create-binary-archive.sh
Size

4KB
MD5

a7d8a95ff41e6c2260d825e985dc8bbf
SHA1

3d4de8e65826133cb7c433602e1313537b4fb408
SHA256

02230e4cc625656f650eb78632ee3648f87409a3e17095757849b590aec4f7f5
SHA512

71734009c0ef9a4c1960eff4ad306ca4c04520ebf70f477f1a4164496e3d454be594b5ad84187251e7d1dae8f79424d02354ae051100bb32a99c5cd117c3bd83
SSDEEP

96:ocSdA4m99A6CB5kZ650jm5IgUJUot+IFz5/tjM2HSKw82TwmV2wRJdCmxDUycwaq:ocjDfa7q2sApw1uH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629259545-4196337482-2684730723-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629259545-4196337482-2684730723-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3720	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\qemu-9.1.0-rc0\roms\opensbi\scripts\create-binary-archive.sh
1⤵
- Modifies registry class
PID:4772

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact