128fc5191ada9b75184152b025236023e1f36eb72d4e172b41a296c108cf6f3e

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 11:37

Target

by Vitruv_/datapacks/MCC Dodgebolt/data/system/functions/color_settings_b.mcfunction
Size

24KB
MD5

511b94e5351f151267d47d0d3f9c09e9
SHA1

1dd1ea8ed2a099489819b616c056872cecf1fac8
SHA256

9063d10b3e0033eb09a374fd400091cfea71b8c7b6477b9286980f03cd9583bc
SHA512

6e8790c16947c7e6df6ca020f9a995b5d1441dd1493d2c884bf1fc319ddd592c528807d28f868c44cd93494c6f6b1c8f0fcb278868c1960411e668c8b781aa07
SSDEEP

768:IWlgvxC+Wd27M6p+FU7+t/g+c5pk+OHPggbk2iRAOq/LE2lO6Fhq4C3l5LochuP6:IWlgvxC+Wd27M6p+FU7+t/g+c5pk+OHY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
392	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\by Vitruv_\datapacks\MCC Dodgebolt\data\system\functions\color_settings_b.mcfunction"
1⤵
- Modifies registry class
PID:1692

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact