87e875dbcb220c06eeef00fba2f38304cb3028641df26d1799c6b8534ec1ce1e

Analysis

max time kernel
14s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:18

Target

ChessBotX Trial/Config/Delays for bullet 1+0.cfg
Size

84B
MD5

af2e825ea6e80fb5e10d9da97a31f39c
SHA1

077fe6842541729adf3efef673c338bafa724fcf
SHA256

d6e1a4435c11e493c4ab3f8c9a2e0f0615463e1e04516c2f9009438ee4cfc76a
SHA512

2028237f533bd97c679109c5a131ddd22e287683f5c817379c7e19643a18d97b4d95d36da987cf7fad16050ecd73c20e3ea3a6b89b4bb70f23452d7d6b9d8ba7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1928	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ChessBotX Trial\Config\Delays for bullet 1+0.cfg"
1⤵
- Modifies registry class
PID:1480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact