b87b4a52420908ca443b973a854c650b1a0b2ef436854ceeed320bd0357aff43

Analysis

max time kernel
126s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 19:17

Target

obs-plugins/64bit/locales/af.pak
Size

355KB
MD5

5c804b81984ff0807b8aaab6583f20a8
SHA1

f015b2280ba837205704b69a4cd39a2f0a22e417
SHA256

cb2003c9630f46daf0253b8d655eed332121c12cdc8114881e050ad2249d9f53
SHA512

113595986ba3b7e10365cb86885c5e3d47bb838c650bb0fb59453887e11cc8eca5622659e43fbb4891a88922962c6c856036b26b60270742386746f8ba308e1a
SSDEEP

6144:8NcIoSUWPYSC1cll2fNlx6MV85D4uEh/kQjB6KAxuIfgayoxzsB+xSD1yMYi5V3f:nIoCYSUvlx6Mt/h8QjB6KAxuIfgayoRe

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2704	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\obs-plugins\64bit\locales\af.pak
1⤵
- Modifies registry class
PID:4972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact