74ca79b7039f84f063296dee527f17369326c1437361a58357ad2bc6f166f65f

Analysis

max time kernel
147s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-09-2024 10:50

Target

LBP 3.14.0/datapacks/LBP3/data/bastionbuilder/functions/internal/extensions/hoglin_stable/lower/lower_0/rot_90.mcfunction
Size

4KB
MD5

ce3472b185f769e2199c741bbdd4570d
SHA1

2aad6b2005b548b5751b28217449debfc3f5bce6
SHA256

37a75d9ff76fd3048b6dea64ab16f0784a506f46faf8371afbdb4fcf27c86c72
SHA512

ea6066844d623b206d16741aedc06d7bc35a41a49569a440432ba936502f72643d52dbc284fc6517449b164edc571b5c0396b3c048ce074079e0e32eaf2dfc67
SSDEEP

96:26u80ZvXoVdPaPIuGuoHcLZg3eq8sT7vKu3X8E3vu6DuEuQ5GTR5OVZ:JnlZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LBP 3.14.0\datapacks\LBP3\data\bastionbuilder\functions\internal\extensions\hoglin_stable\lower\lower_0\rot_90.mcfunction"
1⤵
- Modifies registry class
PID:2544

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact