e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
90s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
18-11-2024 19:35

Target

Sys/GameSettings/EB4.ini
Size

535B
MD5

9c6942d10705504d1c5d725ef9d34e3b
SHA1

0be465c88ce6f34a7663832fe94a7eef5aa3f069
SHA256

9b660b79f608216212320ab1e7958a8f0b2151c232f48f1492fe12c8e1002c0a
SHA512

df204090139533d2582cbb0109adcb82278f5bd327f0ab0c330d507253acff67091a1e1f2ba4086d8b15c6186d4fb69c21020c31f6e3283f5ca1eef5f85ab4a2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Sys\GameSettings\EB4.ini
1⤵
- Modifies registry class
PID:3404

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact