dd8ddd975105d7c9766b165c1c8dc9bd863b08d26acd1f06f70c5cb032a79e7d

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 20:48

Target

qemu-9.1.0-rc0/roms/opensbi/scripts/Kconfiglib/oldconfig.py
Size

7KB
MD5

8c3ba98ac55aa0a5e1c35581f744a39b
SHA1

9a4d3d889d115cf7240a3e5a92b4c3fbc507a7bd
SHA256

06e2c6d68a8bd4922935f414731a5f1068f473710a233d0765a7f8825840d62f
SHA512

4ef210acd76b9b5aef783f0e9aeff08fd7a1dc2af57c8636308972fb7769213b799d97616bebe80680769649b759be9d2c78ba8e5c1c2c6f13d7281a97070908
SSDEEP

96:cHwrlhRvgKkNr2bNOoqxx3xyPjiNhWZLFBBl+cdyaze0Q6GSdzMAXUJUGHO7:cHwrngr2gxCjiN4dfBUcdyazGSxpCHO7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2972	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\qemu-9.1.0-rc0\roms\opensbi\scripts\Kconfiglib\oldconfig.py
1⤵
- Modifies registry class
PID:1896

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact