69943738a2f0a000191138d02b8b2395c0a110027e801da8f6a2a4ff78861c3d

Analysis

max time kernel
132s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 14:55

Target

Lillian Night Succubus Exclusive Contract-v1.2.0/LillianNight_Data/GI/level1/6b/6b561e693a8216de1af4cd3bd3710084.rpc.sse
Size

20KB
MD5

8bb06acc62e0eab21ef75aef3c4ae763
SHA1

29e6496fb99f95d1727ca07cae4505c556384755
SHA256

9b8f25a7257a5b6c24936b5d3906d265f54eeb6c2e638c8ee1062bc68427f78b
SHA512

feab6e633255623420e67f73ae1a49b4e244808db96545e9668dc22100ce0fea346bb8ff74ba12758a4ffb206f3c9a7fdb7c3e6f3e7cc87e2187a47824f80cc3
SSDEEP

384:O6QohSAknNOhfdn9XZ5ogaxinY3FdkL5AsvsvFYUo9ALu6:O9KSAkcRdn9XZ51nMGLyskvFYb4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3080	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Lillian Night Succubus Exclusive Contract-v1.2.0\LillianNight_Data\GI\level1\6b\6b561e693a8216de1af4cd3bd3710084.rpc.sse"
1⤵
- Modifies registry class
PID:704

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact