adaaf38e5ca03aa12b1c895e5cb76eb7ef9ff2915bec9996fbf83c3ce382a612

Analysis

Target

DXF/H244999.0EL01_REVA.dxf
Size

702KB
MD5

6cde64366fdae0f18ef0430f1ba73936
SHA1

492a4f5bc0829d796f4db2ae21d610b70e85b0af
SHA256

d1acc151325a87091c456574e0849ed7ec158006d160864aa8ba5f540486337d
SHA512

d67b583a525d035d6855833fb241341b204bf19e9ec6a293ac7a4d7f8847be9c8e141e8082f0034d37b83b5d34f3b062c906e9ede738920d6b03807b8635c0cc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3328 OpenWith.exe

pid	process
3328	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DXF\H244999.0EL01_REVA.dxf
1⤵
- Modifies registry class
PID:332

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact