128fc5191ada9b75184152b025236023e1f36eb72d4e172b41a296c108cf6f3e

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 11:37

Target

by Vitruv_/datapacks/MCC Dodgebolt/data/system/functions/color_settings_a.mcfunction
Size

24KB
MD5

c0de9f2bff486b1373329d6105f49b0a
SHA1

8b8e51c4973b4b1fa808e2b6bde99fcd1e4d5143
SHA256

055a49a1ab3683505610c31625b7f8cf2f6e9339a464011234a1c3cc864b72ac
SHA512

ad5738af8de9de8f70d30fb21e36e3c53643be3b3cbb6251643dc3ade83de6519f316dc1bdf12460a09e8643326d029ece5fad499269ba2837834e97cdedfe97
SSDEEP

768:ISbyh/4+UToFKE3+Lta7geZ+Vdv087emmYdzX5XYkzGkGWLx5eDCGVkG5ta2v0JG:ISbyh/4+UToFKE3+Lta7geZ+Vdv087eJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1376	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\by Vitruv_\datapacks\MCC Dodgebolt\data\system\functions\color_settings_a.mcfunction"
1⤵
- Modifies registry class
PID:452

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact