adaaf38e5ca03aa12b1c895e5cb76eb7ef9ff2915bec9996fbf83c3ce382a612

Analysis

Target

DXF/EN_HRS-Info-labels.dxf
Size

472KB
MD5

278d4a665698af057b7c1295e89bcc5b
SHA1

9d4a995c731d44f0e8e65c5fdaf0b1cce367dae1
SHA256

ad3e2855a77a258844f1d5a20ab8f7ba6f7f1c3325e504efe712111f01792478
SHA512

0a06e3ec83c68a7853efc4f03b4292a0f00424122328d38fa53947c2b176927b86d955a1ca6a58e2c51f43172389b2211d5039156b5edb27eb6c14e6caae086f

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

OpenWith.exe

description	pid	process	target process
PID 1940 wrote to memory of 3088	1940	OpenWith.exe	NOTEPAD.EXE
PID 1940 wrote to memory of 3088	1940	OpenWith.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DXF\EN_HRS-Info-labels.dxf
1⤵
- Modifies registry class
PID:3200

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\DXF\EN_HRS-Info-labels.dxf
2⤵
PID:3088

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact