a97caeea5750215ce3f795d9e309e43ae4afa66ca3092e172ce66688996f0b29

Analysis

max time kernel
81s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 21:27

Target

Guitar Rig 7 7.0.2 Setup PC.7z
Size

437.6MB
MD5

58820c53dfea2fad758c41eb33adc1f3
SHA1

0e376585eb272f32c7e595a4c47b8420c3a11da9
SHA256

711969182512cddb8beae6aa2a7ced5102631e578b4e081c26f8a6064fab2c1b
SHA512

593879f7c8b6b30a0f3c12394ca0f320ba9a74eb319ae95e6373dd8309dd4c9c5d870c22698f63b68b84d1d586bd960ca04809e24fa7a9ce670b3a4329e5dd7c
SSDEEP

12582912:IjOHdEsBxXmDMgeHf4pvknWmBResghlUb:IjSpXmAhH6+WmBReThqb

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Guitar Rig 7 7.0.2 Setup PC.7z"
1⤵
- Modifies registry class
PID:5036

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact