0a19de24703eb60b228334a05bd14426b58c3cd011e90bcaa9145adce920fc04

Analysis

max time kernel
31s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2025, 13:23

Target

Activation/STEAMWEBHELPER.EXE.pf
Size

26KB
MD5

7aea61a4ecf5352fe47743bcabf11ead
SHA1

e11f6f67ff4fd82185d397f8be827bdcd7f501c7
SHA256

db4dac3919addaa5672c252761a6d1e9328cfdc604bd7e6cce2d45ef253adf1c
SHA512

24e454029419850441e11361749f8c31cb069ab54163c0cb7c6c3e0a9e2d7e561def90fc6c61fb1f5c0c483a5544b783bbc61affb3b3d7c6081b384b5bc074d5
SSDEEP

384:B72Ml1tWLaXvkVG8qGjflds8FkNZNPYTvOOktNbi52e4lo045h:BCMl1yaX8VfqG/s8+NZNATWt052U045h

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Activation\STEAMWEBHELPER.EXE.pf
1⤵
- Modifies registry class
PID:2708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact