a6c0aeafe86b205f27c89daa5f4950f8c314ac88ecac9fc0965dcd65d01edcb5

Analysis

max time kernel
92s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
29-09-2024 18:32

Target

jre/conf/security/policy/unlimited/default_local.policy
Size

193B
MD5

2a0f330c51aff13a96af8bd5082c84a8
SHA1

ad2509631ed743c882999ac1200fd5fb8a593639
SHA256

8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
SHA512

2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
252	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\jre\conf\security\policy\unlimited\default_local.policy
1⤵
- Modifies registry class
PID:2324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact