11438a5e03ababdc7aa308a1c82fb1685c58bb0d4b0a7e3b0a2af7a3c28b62f4

Analysis

max time kernel
312s
max time network
1610s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24-08-2024 22:47

Target

gasai/overseer/aliases.json
Size

6B
MD5

16450068a58d20d2057e0ecfcefc55dd
SHA1

11ae40f7cd1a922c6e3f529b803e43bd74bcf676
SHA256

c6f8281620c2b87cf6a94f523311eae977e420ef9a6cda8667f61be906ceca90
SHA512

49b12b23511a09a05c97c2afbd415340fe78909f86ab33e481be512262f225be49e5473fb6bd2b904e0e46958f9f28351c933f8aaab51b319ae143287b3c7a9d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4460	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gasai\overseer\aliases.json
1⤵
- Modifies registry class
PID:2104

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact