5bd1981e9a8b2c17a40c5db9a7af9e3cbbd8893bc08ea678dec0daf55efb2d59

Resubmissions

06-01-2025 13:52

250106-q6fd6sxrfx 10

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dennis RDR2 Online Cheat V2.rar/Language/de_DE.json
Size

119KB
MD5

b475fa31d2dec434d81077cd0b50ed0f
SHA1

3c76adeb7145e50f91f0dd42278ffe67aa4a9531
SHA256

446b3f803948ce411c1a8b7fbbe06275247cbb780be6db9f1c94488fccf52aeb
SHA512

acdd0b320c8bb10a32b75cdd778de58e72f66441057e9585b6a73badb5403cf46223d5c30bc88105d8b63ff340ea3e89f6c4b9d06f63cc950b3e559c3f4f61d0
SSDEEP

1536:TG+M/On6HmjNbrVa1GVJ0kG3IH7ytWc0xaMXrKZSDJmcBUwi8A:UlCB+Wc0xaW+IJmoUwi8A

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3688	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dennis RDR2 Online Cheat V2.rar\Language\de_DE.json"
1⤵
- Modifies registry class
PID:4768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads