b365aca4f494c6339edbcf437d32a16f40f42e3ef6e8fbbecce48544e0d75610

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 23:57

Target

Rec-Room-API-Tool-Box-main/FullTools/AnimatedBio.py
Size

598B
MD5

0dccb95095de89d0327cf858fba09213
SHA1

6511d00b0ad8c26536b4e9607738f0ee8d09b155
SHA256

e73685c7f2c0d5c9dc253eb17f0203fd45c40340c6c6799a6560c187fbb052e0
SHA512

b0b5684d74a3dbced50f5773bb14743080225e8bba7df8e9b96ab8d837c7cf93aae5ce864c4e9b2d8714d4911f37593e5757cdccec30e6ae2473de070172345e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2252	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rec-Room-API-Tool-Box-main\FullTools\AnimatedBio.py
1⤵
- Modifies registry class
PID:2716

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact