c05f8e1cc08e6fa7a21a5042d063d6e2d7569129db332491312b01b12aca037c

Analysis

Target

PDF - SansAmi (docus français ).rar
Size

95.9MB
MD5

7ae2c12dd9e1c0978b46269dfc8420c0
SHA1

44b31dbb921022ca38e174ec6a7da8664a3e654e
SHA256

c05f8e1cc08e6fa7a21a5042d063d6e2d7569129db332491312b01b12aca037c
SHA512

9c447fdfba0be77ec57f06f27c389b096b1e4d9994a2d2fc9ea7ea9b10e02c2e36fc9ce11abb6025217e477b715d08156bfdecb0d49f283aa6a0411f90edebe9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1860 OpenWith.exe

pid	process
1860	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PDF - SansAmi (docus français ).rar"
1⤵
- Modifies registry class
PID:3920

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact