1025d1d8ded39150086a76a16ea84b0719f0e6594900ce066f617ad620aa5ee8

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 18:38

Target

Blitz Hyper Edition FV Honey/chars/Amy/CNS/Arcade.cns
Size

13KB
MD5

11692ce6cdd4411d311745c0fec7a30c
SHA1

80798577eaa4c3e461fa58c60a889dc71d066737
SHA256

b947e2252ea09ef3b20c57948e9936278ecbb5142bf459e2e6e4c0a1614ad84a
SHA512

5aa3ef55f48a3c424122bdc9fb70465a186eb89df90819a9bf99417cfc659f9f0ba8557deba220d6a490b958188081a48f75704336f4269274592ff145e0e386
SSDEEP

384:tYMyXE03xnHphjXKfM5BXSnV4vVWg8XIjsZ2pR:tUEKPDKfM5BXSQW9IIQR

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Blitz Hyper Edition FV Honey\chars\Amy\CNS\Arcade.cns"
1⤵
- Modifies registry class
PID:832

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact