adaaf38e5ca03aa12b1c895e5cb76eb7ef9ff2915bec9996fbf83c3ce382a612

Analysis

Target

DXF/H244999.0EL02_REVA.dxf
Size

294KB
MD5

b25aec91ac0f0dca172603b85a409b01
SHA1

7ecf4328653544d8a3eb4586ec8dcf76c0283388
SHA256

0edd6b812442b4ab0214800f4676fbbfb01ddda172de4505c4e35078c5184685
SHA512

83db1cfce62698cc4a923fc5e77206eaa6d24e789bc12c10c6a7c1f08703eb2cf429887960dee4f2735704fb36955408fdb4e0fb4f42954ac46dc55847652e92

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3596 OpenWith.exe

pid	process
3596	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DXF\H244999.0EL02_REVA.dxf
1⤵
- Modifies registry class
PID:2000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact