9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca

Analysis

Target

01/2015.5.27/01.vir
Size

1KB
MD5

931257e136ab519589132594ab284e23
SHA1

9d3d78d1a3f7393abed6d30890f7474ecfa8c1d7
SHA256

2113e6037585f1a8d8632900ca49840e22e5fd044855cd7c9f6a8f2382357c06
SHA512

12a6bf72bc87764653cb0ab24d82ded8ef4264c403a567fbafa25f5ff6558bda4ce713a8df9b42ac9209e29057769dc39f8c78323dee6ca386f09776d29448af

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3596 OpenWith.exe

pid	process
3596	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\01\2015.5.27\01.vir
1⤵
- Modifies registry class
PID:344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact