b250a8cb9042a96d90850ef165b43cd50624878916ab0dd259a577032912e055

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 18:57

Target

.text
Size

29KB
MD5

419d4e1be1ac35a5db9c47f553b27cea
SHA1

81b88fd425125756d41fada07ae1534b10c43c01
SHA256

97e6da0d74b3c02e39efeb02c6f019b353e9891a3ea453f2fa0ecca3c3e526e2
SHA512

17fea0a8c963ec9a6bdc562de750a4f8f527f2555f02d9df88b4e9ad41bdbd7fc37c0a303562f4834c195b485cc61284b6e19723bb376c23e08642884b70c121
SSDEEP

768:JsGPXyrvq/Sb6LbQ7eM468vxRu1rnd6ffMmKZS/5hK9G3/2o9+4gn:WGarUa6LowvuhdNYh2Gf9rg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4400	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.text
1⤵
- Modifies registry class
PID:2324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact