19d156d205df792a4a8c881b2201c561c9f74babc40cdb8ecd7f55d68f3c135b

Analysis

Target

ExeFilter-1.1.2-alpha3/DEMO.bat
Size

40B
MD5

2b34480d75ba452ce0d826d75bcce5f9
SHA1

2c0c0daeb77eea418091fd0b55a9fb1cce30b117
SHA256

f46514b4b88e3af161019ab12d009f2b81a5e7c4234049e0e5b5cf70eccc7258
SHA512

737451a9cf516e596ed8841c759ea7dae3f54f36c639c9e169856a3f7823df82bf8265aaefe6cf371d3aff0446c6191fb188f7f67dd8d54bb761338c4b58a0a8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4144 OpenWith.exe

pid	process
4144	OpenWith.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExeFilter-1.1.2-alpha3\DEMO.bat"
1⤵
- Modifies registry class
PID:3708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact