110ed2f09d165b3a7ebb28eaf7d1217069e352c82b6dde598ca6a70befb98d1e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 13:41

Target

StardewXnbHack-develop/StardewXnbHack/Framework/Writers/IgnoreDefaultOptionalPropertiesResolver.cs
Size

4KB
MD5

69494ff9f28325943259a96bcd96f598
SHA1

a194b0e1711be7a479c3fe0b6d7f26e7014e1830
SHA256

0a0c072fdac8af651f6b02330ebfa1dc077c2b19ba64fca5523475e59dbc3236
SHA512

c97807108d86b0c7e6e5862711dcffa23013863cd170e6778ab89b10b4e0ce19f05b63c689eee72d30da21a879ddac9d667edcefc01f187baf2a445f0c0d8618
SSDEEP

96:Cj4Y26NVsOyxSii2IJLzZlfmttonB0mumUmHRmqOL:tFeysoIZPmtM/DOL

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1616	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\StardewXnbHack-develop\StardewXnbHack\Framework\Writers\IgnoreDefaultOptionalPropertiesResolver.cs
1⤵
- Modifies registry class
PID:1200

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact