824dcdd9992d95e8d435c223f7ca465647106106c1115cda058a75a29dcebbdc

Analysis

Target
INVOICE.r15.rar
Size 440KB
Sample210720-pdmtfffz9a
SHA256 824dcdd9992d95e8d435c223f7ca465647106106c1115cda058a75a29dcebbdc
MD5 4833a3dc62154363ea11700ad7d1e6f0
SHA1 95114e7767cb887d2d55b49bab12d38faf1feba6
SHA512 b3f958882be2fa26ecf5943884f58edf64816904d107094fc5dfccc3a9827b16efad13797241ae3e73af5b9696fd8be100ec502f1de5909a3550c850eb0c68e2
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\INVOICE.r15.rar
1⤵
- Modifies registry class
PID:992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact