adaaf38e5ca03aa12b1c895e5cb76eb7ef9ff2915bec9996fbf83c3ce382a612

Analysis

Target

DXF/H244999.0M01_REVA.dxf
Size

4.4MB
MD5

c64d8a794488d2b6b13210933ddd53f8
SHA1

ea8b164b25c0d47d7633f060d9db694d27db85de
SHA256

963f9698ca12fb4df9d2762af65140a12305f78a69f867585038bf1ef862d701
SHA512

b80ee9ff8b131317d6e38a57574cb3741c0d278ddf56ed51d946587d150bc458f27601fd520cd3e99b0f9297f18ff56a337a80c594a452e59801c771466f4737

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1372 OpenWith.exe

pid	process
1372	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DXF\H244999.0M01_REVA.dxf
1⤵
- Modifies registry class
PID:3532

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact