9e0a15a4318e3e788bad61398b8a40d4916d63ab27b47f3bdbe329c462193600

Analysis

Target

9e0a15a4318e3e788bad61398b8a40d4916d63ab27b47f3bdbe329c462193600.elf
Size

131KB
MD5

3313e9cc72e7cf75851dc62b84ca932c
SHA1

b5f914ad11626070f6cf466069c8d5d9ee25f5bb
SHA256

9e0a15a4318e3e788bad61398b8a40d4916d63ab27b47f3bdbe329c462193600
SHA512

7c3f1cce6b3b2b0464382ad923076da3a2e81463ed25a8d1979caa7c7305ad6681d1df32893c9c973ac6a897f6d638720ed7d73dda5b06c99c1fe669d98960da

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3040 OpenWith.exe

pid	process
3040	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\9e0a15a4318e3e788bad61398b8a40d4916d63ab27b47f3bdbe329c462193600.elf
1⤵
- Modifies registry class
PID:3716

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact