3adf1a24d2b6be6d1942dfd603dd4535de000fac2929f8eb8fc8ff6a5448ba07

Analysis

max time kernel
124s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 17:07

Target

riptweakcracked/locales/ja.pak
Size

164KB
MD5

781fec59b38a21dc663f3a482732196b
SHA1

1b660ba0bd9aaf67c5fe49a372687facd6d264ea
SHA256

3849f8b48b034fe6319112eff77b7c9f6a8d7b20cf7bc8400528a0a8458677da
SHA512

f2c3a6d8c23f72db8e70ec8cd87793eb103b58bdd3976e99f42867c33a6688a41c79eadcdf25c6ae01fd20920affd43f228a5134af28f83ee50fe02819665e95
SSDEEP

1536:Hu9OLUlhagNjy/d4thSbFsSM8IpB46XeyOsg+Ft+nFUNjyNLAVK:qcUlMItthSbFFM8C+ZiFt+FijyNLAVK

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5060	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\riptweakcracked\locales\ja.pak
1⤵
- Modifies registry class
PID:1656

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact