00ce60772b4b2d518f06f60c9b895a6f5b121371f45e8f11519b58ea09528d12

Analysis

Target

f_024f7c.gz
Size

297KB
MD5

a2daa7204000eb216cc449588c9f2d52
SHA1

6d40be1f49a757771e20f8e23923c7e7576dee71
SHA256

012081e66abbd21d2d749444d27f9611cf1059051aea466ef07b7b20a3fb423e
SHA512

6d789732b4b367bf4788469a2751c6919038309b0aeaf915faf9bb5a1e60694b4ff8c96f8d8080c8d160dcafe6847186e8fd92aec3a5db4f2a44340c4229d67e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4292 OpenWith.exe

pid	process
4292	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\f_024f7c.gz
1⤵
- Modifies registry class
PID:3216

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact