4a9f863bc2b653a78885958f4062b42b1989e045728cac836374efacc066d09b

Analysis

Target

Log4J Malware/Elknot/90ee1a8e8f0ea5085b83b8efe174674a93260b599729bf53e1b140e2acc7d26f.7z
Size

362KB
MD5

86a016b9b15f8b409b1b022069c1eb42
SHA1

fbed2f40fac21a2ef654026e37eafb82fb9f4ca5
SHA256

f43aa2f2aad2308deeb2d2f5f01280f1a544412d8805422a7714d9bf758c4fe1
SHA512

49d7c6b2b64903b149c0337a7ee7463a6e6fa8abcf3a6d2c7456f854b5f8b53535280d936a2499d803e1258b25994ed805ae90f197ba18ad81301627c7c26430

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2328	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Log4J Malware\Elknot\90ee1a8e8f0ea5085b83b8efe174674a93260b599729bf53e1b140e2acc7d26f.7z"
1⤵
- Modifies registry class
PID:5104

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact