262a338179e13e2c4d97dca80119baf2438eaca30a5675c7fc5ff08654523a1c

Analysis

max time kernel
2s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-09-2024 03:41

Target

Data/MiniGames.pkg
Size

3.0MB
MD5

8c6785b90b4146179a0ef7cad3f82bcb
SHA1

d3675d8325fd5ed4bbd8a3e3894a43564342288d
SHA256

c36f138d2379f06ecc6fac9af8297f31212c2dad7ff3385d5a79095381525248
SHA512

0d30c1254764155fa0f805d4fcf3702c34cc6d8ba8004af7a25b20e5f41a49f1679d0ef8a8a73b76c66efd3cb81c4c8694a85d9fcd8f91ecaf39b0800720a08b
SSDEEP

49152:Mm3t1grM3uWZkImZvEzG2hzBb1VtY8EmwW9HgCvMqSpDzrUiWRjgwM3wFKs3KXv+:M3rSZkZcbbuSgCvMqAD3UiWRjgXwF14C

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Data\MiniGames.pkg
1⤵
- Modifies registry class
PID:3404

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact