4bdfa8e89d95d1ecedd2b2793d8b21c0f71c8183adc10b469bd4032d461fcf75

Analysis

max time kernel
142s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 13:13

Target

sample.tar
Size

9.7MB
MD5

a8e5f9e3ffdbd8e8f4dddb861cbff794
SHA1

4b7667ca1653519f5c5898dc5766bb118100ff55
SHA256

e70487065bf1017f4b09fd68a1032222e5066b0d2191059c962fff55b8cf89e3
SHA512

04fe8f420d47887cda70976dd216446a5fde157d3e0eb1fc56ad5f535a76dc5d13e992e547939cb603ea94608f4b2d9eb2f94893f479380041bbdb51ee5186fe
SSDEEP

196608:OxwLjt17fTacw4R8IY6NFJh1yw93pbBDlIkhvy9i:OxwLjt17fTacw4R8IY6NFJh1yw93pbB

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample.tar
1⤵
- Modifies registry class
PID:544

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact