bf791a2f43ce7856ad76c87f06cb323735a92acb1a4f17f4c5a6ea93a973ab19

Analysis

max time kernel
433s
max time network
436s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
27-12-2024 11:11

Target

data/cam.apk
Size

7.7MB
MD5

a8c5b0d86b8dd513bd20f5b9a9606882
SHA1

bde5786b680a755aabe94f6ad3b17fa8f97f0432
SHA256

fe854c096ae40097e867272ebac8c77c03662b361dd9c2f97223378e1ef443b1
SHA512

49a7224c0f075e9c0b8b25f08904aa060a6c731eca5e57197f87fa29ba5bd62e3fc0f3bde7f9b773aaf8b7ff7cd4bd6f169a6fb0733347487f961efce09c9035
SSDEEP

49152:3hJpR+H2tGU6RjmeHbrrDgAG3i75CBLL47/Rm1U2NHcANa5yiS/ojZrjHLV5ut50:3hJpR+HIGUeHbrjh5sXSWa5ZfLfgnjM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\cam.apk
1⤵
- Modifies registry class
PID:2828

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact