8a2e5e073d34f4fb7cda2040d30e23d60cb675b71120e0e2c39838015c66f306

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 10:58

Target

WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.assets.cache
Size

22KB
MD5

660c4417d85a12238745f111f1c7162d
SHA1

fd207f8b88a96273fa15d2eb88bc91da8d44f065
SHA256

715e840bce14560cc4b6f0a5c05bc17f8eb8e985b1e0e96235c06d17f1cefae6
SHA512

b51fa8898dca71b503e06525427de69d176c87642fe4a241f9adb51c34c3d4d812988b0ac8b8615ac4ba0b2c66291fdc138328fc0a23dcd7073f266b9cc56a9b
SSDEEP

192:ez4y4I6Tm6JZeHhMGDiAm1SiOVkNt3cP+ru1lG3eKvQCmb:ezMI6TmHFiAm1kVkNt3cTlfKvQCmb

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3988	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WaveKeyGen\obj\Debug\net8.0\WaveKeyGen.assets.cache
1⤵
- Modifies registry class
PID:3984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact