6f627ccaede437d4768d2bd22d6f9172077d45f239a1aeec8eaa75cf0f2f6f4d

Analysis

max time kernel
3s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-09-2024 23:09

Target

image logger V2/tools/sigthief.py
Size

10KB
MD5

1be0d01d21dbb3751282eb7ed647873b
SHA1

e475be8d256eec456f64cbd5d3f603fb6aa7be6b
SHA256

9b7c335f3898b7b2564d1ab484c0b271a8c0e6ea679cf1390d1e6fce2553517a
SHA512

a934697fa989a414bfe889d36ffebf7001718f1005351bd51f9ef8b4727b9f08da9f10c23b970af8c63dcdaa0f7babcf200d863c8cc69f6eaa63d300f7a07cdf
SSDEEP

192:gPj5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:gKyMSfUU1l

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\image logger V2\tools\sigthief.py"
1⤵
- Modifies registry class
PID:1320

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact