2922d5a4f2de932813d21422303133e01b9ea0ead5714b58f075f6afaf960b80

Analysis

Target

Survivalcraft_2_3_Multiplayer_x23_01_31_VD_zip.zip
Size

16.7MB
MD5

2c341d93784288891a95dcebdb13f0cc
SHA1

3221d07491579b7d4290c22688760b64360cdb14
SHA256

2922d5a4f2de932813d21422303133e01b9ea0ead5714b58f075f6afaf960b80
SHA512

05cacc08227cc34c3beda2ba521a6c8605d8194924c627f46bd3da2d1bbe798cb5ad2b4061927e1521aef98cf579fc2607c41f62b1158c4e500a38a5a4a6397a
SSDEEP

393216:MSRqleDPCJUDaek0bDrnnmmjestwC0GfeQfUpLPKO4zojRFBwQZJjw1RuCX0:/6eGJeR3znfeywITfUlyOTqQZd6PE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Survivalcraft_2_3_Multiplayer_x23_01_31_VD_zip.zip
1⤵
- Modifies registry class
PID:4028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact