e5e4bc9b97c9c6fce7178373bd1d6e6204aeca5b0e9af8100cdbcaea9b8a8020

Analysis

max time kernel
93s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 01:15

Target

capesolo-0.4.11/CAPEsolo/capelib/cape_utils.py
Size

4KB
MD5

8a2fde84caf9537ed4b4708ab42e148d
SHA1

590d2c0ba556a119fb68f96d49e5fd4010964537
SHA256

6a0918bd458e61d3c04348f9525fe90f54f3e913ece56e9c0beaca62b13d5d1a
SHA512

d90aa4d9ae8e24e1ec8b707ddd2b30caac638a253a22067885dfa110892ed3d6ffce1f4e4d9a6837f4946cffad33bdeffb2ee4434d768e44fed5b2e78d6ca423
SSDEEP

96:nz+zfF0Y568dv5N1iiYcWKZPVgZH5gSDJstdZFKmBMj/m/:nzYfFHpRriRBnJst4muj+/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1840	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.11\CAPEsolo\capelib\cape_utils.py
1⤵
- Modifies registry class
PID:5064

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact