262d6420018c8000d4f95686b9b6862737b7bd46ca94916c0c23d4ae603a8e5f

Analysis

max time kernel
92s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2025, 19:10

Target

Cyberangreb/Acanthopterous29.bus
Size

204KB
MD5

566babc802e773a29bb44f167b8f0174
SHA1

999d16a5e7a9d26e846ad4c0e7eb3aa6e844cc2c
SHA256

d78c7bf755f26aa42c1f9a9be74d10c22eb81760b2b5ca664a56aa559b63c781
SHA512

0111fd8f094f3e025c92a71b4d289439574d21d881e14ecb34f3f5a3f60e84b58637e0b55f0aa4269b18b24e9fe046491f0ec474467d17739a79e3647ca4e137
SSDEEP

6144:A8KQEhQiWL6SvQ4huRk+tlJvpCaIzCX4CjTI:A8WQhlQ4huL7vX1oCjTI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Cyberangreb\Acanthopterous29.bus
1⤵
- Modifies registry class
PID:4176

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact