6f75e4e4094e055f39022d677bd04e89f58fa9934c2ad4e10dda4c4b41b0b3e1

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 02:16

Target

Aura/com/google/gson/FieldNamingPolicy$3.class
Size

938B
MD5

8e72cd9d484797032505dee1dc723d74
SHA1

f0d8f30a0f9db59bd00fdbb1eb114d642c491e7f
SHA256

4b2d181c33d3ca363a787995b2b54ad817c06be36a4d63bd7eeeb49a27e67133
SHA512

46d507ffc0713901f3bed2f31103370f794f5442992ab98a6ebfe0f4592245da86c9abd167199df85607a524ac105e7a921ad6faa32676db1740447930e2820e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aura\com\google\gson\FieldNamingPolicy$3.class
1⤵
- Modifies registry class
PID:2672

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact