8022a621c92e184374fc1b29076c4d1f9b2d46f9cecc4f4921fe27045ce3d740

Analysis

max time kernel
146s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/08/2024, 22:50

Target

Black Myth Wukong Repack.rar
Size

61.1MB
MD5

e1f25d8f3c80d1cc5b39c2b24070bf57
SHA1

0c84599a43de998440824791bec47f8358290eb1
SHA256

c0a37ab9fb2f53586019cb98471d1222aaae3dba4ffb4573ceeedee0ceb19830
SHA512

4ada352ea0e3a351b2ee66e4ee91c2fdbdb6d6712d90922fb13366fe1defaf1e26126faae06e166b551f5ac7525352869f7119c70abb6a867e1a5ff19065de29
SSDEEP

1572864:4Ob4+70wrxc/Ezux83BxbL3xUENdCdFJdod:m20b/fxoB5L3x7dCd7dod

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3936	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong Repack.rar"
1⤵
- Modifies registry class
PID:5008

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact