702e1fc59814d4427bc7cf110556824dc4b620b12b1f9461129ed5280cf727dc

Analysis

max time kernel
434s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 21:02

Target

Five Nights at Freddy's 3 (2015).torrent
Size

18KB
MD5

d58ad2f3d80d5a9cffa234e4a8f209a5
SHA1

e1efb118edd56b56fe5043a895b91a69a065a635
SHA256

fae5b71988a782590e59c58b52dace5d4cf358e3db746af2c391c2cb3a07421e
SHA512

470da9a457a851c910054e7062e9b715c32f02219dd1ced2e55b96e34a3867019eb59a11d52e122474fdf5264c4947d1c3bbd39dd23e315cf2ff3469d3c2b1b3
SSDEEP

384:oNzKTNYyuJZvixjNHEBpa4oHM8GFuQJCdRB4X:XuLoNN4X8zhBu

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3796	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Five Nights at Freddy's 3 (2015).torrent"
1⤵
- Modifies registry class
PID:2972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact