c51b710578868212b274ca8bd0b6ab705f79d3e1dd490d4fcfe06d231b6ef7e9

Analysis

max time kernel
130s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15-10-2024 01:09

Target

S0laahgi/inDd/locales/da.pak
Size

342KB
MD5

f3a47e259c59de0aabef03e6b5a263ca
SHA1

c45bd961c8bb84331d652f4399675b365f5dfe23
SHA256

13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a
SHA512

4249456e572403249580905f1b4b4471b6a8d84c6c71201c42adc862d4e0d33f957ae1057109e900a10a029a8dfc45257b0e0e283ad9eca21a30498a0795eff2
SSDEEP

6144:eAzv/f19wl6qKJwRXFGZO2Z5nYryGzOWi05TWwc:5H9IF85Yr5T0

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2396	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\S0laahgi\inDd\locales\da.pak
1⤵
- Modifies registry class
PID:1892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact