e02386ddc6215fda512f352df0b1456bb17ac8e15ed05f631b1d18b466755adc

Analysis

max time kernel
30s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-10-2024 11:28

Target

mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkd.nlp
Size

60KB
MD5

4d8620e00dd771b58534a00218c60a58
SHA1

5dc02a1757bbccbf388466bf6580864d99136e9c
SHA256

a1bd4e75958ccc7bb8073651950f23c7115054a32fbdbefe86f455a3480dbd9d
SHA512

d20b243f615b1232a1924bdcebdda5d89551daef20c6ad5256285097fbbab7ced5fdbbbdef34775889f689387c55622d4e15f3887a3a405d8685eda2d4d9e079
SSDEEP

768:9BypmUEImoYQvP17WgVbFTylKjWvtZ4HkSOUhbBUB1a:ny0UEbQvt7F80jWvtAby6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3168	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkd.nlp
1⤵
- Modifies registry class
PID:1976

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact