666a9baf3d576af52dd63cc3c7ea506234f8b2554d0792eeb03b98282b6bc70c

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 17:36

Target

savedgames/slot1/dlc03.savegamedata
Size

58KB
MD5

1003af73d172f8aecc7dceef03eb3b94
SHA1

164638f3e7c41170f38848c3ff91fe10721bcbf1
SHA256

90e96799410493baa2394dd5351c47cdb0ab337b0098e80aa30fbe8b05d25c02
SHA512

f0706370ed2dccef04410df51a25d02b1de67cdf24a7c09f8d475ffd5637220683198babed353309e8e258a82b86f2eb0bbb73b5b2ceec762ba443bfdc370f8f
SSDEEP

12:yrFlnaVfsobB0fflJVgki4dEKZ+OfP3VFgjlT:yZlaVQfp0KAO33P4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4316	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\savedgames\slot1\dlc03.savegamedata
1⤵
- Modifies registry class
PID:3924

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact