cc32254ee92b96f1eb455999dbeb00ee50732cadf693f939a2b7abe897e8585f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 18:05

Target

OpenFRE-main/OpenFRE.dll/resource.h
Size

402B
MD5

44b3c32e99f608cbb661690a443d0601
SHA1

84fc20626b3374e9a3fcbc2c47253de71e476eea
SHA256

63dc7d962f142d5fe04852619fbf41c6db2c3fd496ef92fa2b90a99df8ebee98
SHA512

4c2bdbb53dab104a43b1790190f3922c662e7d060cae175172ce5e31168cfc55064d3ad95ed9bc5fd400859f9f2088cbffe3b993242a7ffe310734e97078ce1f

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.h	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell\edit\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.h\ = "h_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\h_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2400	1312	cmd.exe	31
PID 1312 wrote to memory of 2400	1312	cmd.exe	31
PID 1312 wrote to memory of 2400	1312	cmd.exe	31
PID 2400 wrote to memory of 2844	2400	rundll32.exe	33
PID 2400 wrote to memory of 2844	2400	rundll32.exe	33
PID 2400 wrote to memory of 2844	2400	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OpenFRE-main\OpenFRE.dll\resource.h
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OpenFRE-main\OpenFRE.dll\resource.h
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\OpenFRE-main\OpenFRE.dll\resource.h
    3⤵
    PID:2844

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact