cc95afa3bcfc0c265b5df90c4b354f95ef382ee875cd2f5ee2aaf3c60ed0e475

Analysis

max time kernel
446s
max time network
449s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
03-02-2025 14:18

Target

ChjokM3/Load/da.pak
Size

342KB
MD5

f3a47e259c59de0aabef03e6b5a263ca
SHA1

c45bd961c8bb84331d652f4399675b365f5dfe23
SHA256

13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a
SHA512

4249456e572403249580905f1b4b4471b6a8d84c6c71201c42adc862d4e0d33f957ae1057109e900a10a029a8dfc45257b0e0e283ad9eca21a30498a0795eff2
SSDEEP

6144:eAzv/f19wl6qKJwRXFGZO2Z5nYryGzOWi05TWwc:5H9IF85Yr5T0

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5076	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ChjokM3\Load\da.pak
1⤵
- Modifies registry class
PID:1640

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact