128fc5191ada9b75184152b025236023e1f36eb72d4e172b41a296c108cf6f3e

Analysis

max time kernel
143s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 11:37

Target

by Vitruv_/advancements/4ce875ea-ee32-4e68-bc36-9f0b04b100b7.json
Size

9KB
MD5

9c5cb498ee1ee8a70322324d1b78b268
SHA1

3f0fc671e44cee6450bbf3dc0276234f2ded8987
SHA256

cb62dab61cc4aaa35a03fc7aea5eb2421d817f9957c485b4b51df3f2ccf12276
SHA512

161fff0fb041d26354ab6fe7f1c6a8402e6e911a3494209bfaeda3c9cd0f6286310f29593727d041675c639ab15eafa2ab5af2bea54418443ef0bcb050830379
SSDEEP

96:B7XhmmtIOWTBPC0V8pZm0s+tC7N778pSL5mueWseKdKYbv7E7s8pL7yt827QL5mn:L25m05T51zth51q

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\by Vitruv_\advancements\4ce875ea-ee32-4e68-bc36-9f0b04b100b7.json"
1⤵
- Modifies registry class
PID:3700

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact