1d49d456b2dad25cfd3a85943992bb0a20ed39ef9a4430a6de5a0fe094ca9a49

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 07:47

Target

shaders/gbuffers_terrain.vsh
Size

8KB
MD5

e7d8ac7da5cfc1c13c6ecb8121fda8ab
SHA1

1de7db6e5e66fbc88ba8a020c6a2bf4befa31409
SHA256

3e7c2ddd719aae3eac53de6d273fd27c39fad2d2ac8a9671445f96794291a975
SHA512

bf172d36d62e72d8b4d230266829984c7f04694f2a423902cf3a3bbd447052d92e648ebb30cfd06062ecc46a72448d5fd1d6ad8b832a69780feabf10cd9f71c6
SSDEEP

192:a2+i4PhwfGI37EN78U2pzXdY38k/xA+JcKCZzn+qyeQUS2B9+t6w7ainEZzPF:a2+HAE2pzXdY38k/xXJcKCZzn+qyeQx6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1200	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\shaders\gbuffers_terrain.vsh
1⤵
- Modifies registry class
PID:4480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact