be75f94398e7a9b047cf025f8b2b1effe4e3c3b8f607a1edec61d8682831525d

Analysis

max time kernel
543s
max time network
552s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 01:30

Target

! §4§lCHATO GAP RGB/assets/minecraft/models/item/.ds_store
Size

6KB
MD5

363129817f4c5f781dd2edb433e167b3
SHA1

b06d019f829c20fc739c67f8c1f253f1b3478ae0
SHA256

3b3fe384d797dc2a834e8a86b80cf748da175d39091645b55a8f067af26a9a4e
SHA512

7a3d2ddeb7736a22263366ef65033c0609a3d92a037adfb5a347f11b03e774b1227bc0487441cfa22f57e6783e7a5ef854a0f829b8c44ac7a48dcdd994e24ead
SSDEEP

12:QaZzFryPq1yeOGk9EEX/HnXw6XgEK0Xw6X:jZx+beqfnVVV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\! §4§lCHATO GAP RGB\assets\minecraft\models\item\.ds_store"
1⤵
- Modifies registry class
PID:4076

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact