c51b710578868212b274ca8bd0b6ab705f79d3e1dd490d4fcfe06d231b6ef7e9

Analysis

max time kernel
131s
max time network
148s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15-10-2024 01:09

Target

S0laahgi/inDd/locales/ar.pak
Size

574KB
MD5

d1d99f4f2045531edc47d37a367402bd
SHA1

825385e524ece779c641a4ce2a57d14ff126d509
SHA256

bfa2a3c3ebb3c6afbca42cb70b4da8f997068d511cf40ee8a952a893b8f9d7cd
SHA512

4255b02c19ed373d711068a2d4639d462372071cc2aadb6afce459d9fe19bda21ffcbf1604e4937617cd5fee996f9b3786be1c2bed4dc4919d849c7a988a6ac0
SSDEEP

12288:el2RFtqr0jXjiRp8DvYUBuSYRrA5SNbr+ATg8Y3MgSEN6h:m2Ru1fRk52+M

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\S0laahgi\inDd\locales\ar.pak
1⤵
- Modifies registry class
PID:1004

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact