5d5e67fb50030d44113ab3fff345319a7fc366957c7f9368e94264416de2dbf1

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 13:07

Target

folder/appinfo.vdf
Size

125B
MD5

0393b3fd66fd9b5fdce28985f5633245
SHA1

b352cc21877b6e73b437db313ecefc5463a0ed9e
SHA256

953429a4fdce3d84809d8f67e0bcbde3caee21afed385af7053a43ed920081fb
SHA512

e80bce5f5596231b6a767e91714acfa3b803c811c32588c228687a7785427bf86d3c59a1c011594b0ad4be672fc914adb4d9d57967833e212b35ebd5c8ec8aae

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1744	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\folder\appinfo.vdf
1⤵
- Modifies registry class
PID:5040

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact