c6d67292c6034b1668a5c8f334d9bbeeb40a534983b7a5a47d0973de89e3decc

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 02:45

Target

✵s͜͡etUp_Use_2945_P͜@s$C0DE✵✔/「SetUp・H€RE」✔.rar
Size

9.1MB
MD5

03c9e14dc45aaa79fc31376e7702dd10
SHA1

1c5726050764eb15b08f0751728d7db36ace9058
SHA256

238baf1490183fdca9ed50164e48b420ef6ef37f2dfeec71c89d346e99fb3ff4
SHA512

a3b8cc2a023af960606e6290b9e9947be428187c2433d683b0aa0e26403e47c34da770cce8b2e631fb5d3af79c47f0d855799b41b472718ce7e2d86c49743cb0
SSDEEP

196608:mutB6AoHs42rMqKlr+LgbrrdNKsauXOhMtzQjxtRNyugRiO74u:XtB0R2r9KysrZJehkkzryTgkV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1300	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\✵s͜͡etUp_Use_2945_P͜@s$C0DE✵✔\「SetUp・H€RE」✔.rar
1⤵
- Modifies registry class
PID:1856

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact