f9d4b3edcdf3085dacdf7ffb3e794b53f3dc0bb5f6f227837ae5c828a97ac478

Analysis

max time kernel
419s
max time network
478s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 13:20

Target

ToX Free Utility V2.0/ToX Free Utility.exe.config
Size

4KB
MD5

d4b051447945580e846848ded72c11b2
SHA1

898e59d491bcbc3d77ee89ed1a76deceac7bd5be
SHA256

2171a301e13b7eb1c57dd5c61e38f899aa566c778426c1af39720354ba04d707
SHA512

1cd36e870a86c9f2dbb7ddc7103c7c35b91fbb9713a5da5cfba3eea52c5c7c43962b9bf65589df2238af47e2563a193720d4e39453107b97f38df9fcf92e6f95
SSDEEP

96:br7M7KtrwvlAvCAvFAvTAvPAvSAv4Av/AvbAv0AvAAvnAv6AvoAvAAv+AvWAvdAh:br7M7OrwaF4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1480	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ToX Free Utility V2.0\ToX Free Utility.exe.config"
1⤵
- Modifies registry class
PID:4944

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact