6c167c0921104098996ef52c4c4ddb8598ef2be44c1caa3f53a3120c3c8acfba

Analysis

max time kernel
1462s
max time network
1478s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/08/2024, 11:24

Target

Valkyrie/banner.py
Size

2KB
MD5

560dd767d8c4126671a0ab0d4ae3888d
SHA1

810bb65f4873c78180d296d257e03faf2d73cf5e
SHA256

9c05763a22b4a9578a70cf31104dddae79b63ef17ee5e9fc6a341c90a26a299b
SHA512

78f47a6df7d5899e531bb532d39e9ab81f80289667d8e79096100f70a76caa0e96e40ce17a29e3e89aab57b3afeaca304fc449e672f8d3fd12d94cbc2f4ec2d5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Valkyrie\banner.py
1⤵
- Modifies registry class
PID:4672

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact