77b4650847cb0c0389bcbe8feda2807d42d3f59cdd3f2b0b07f8dcc04e904fa4

Analysis

Target

APT-Hunter-master/Tools/HCTOOLS/source/evtrpt.pl
Size

6KB
MD5

0149acb962818da6d82bbd877384d314
SHA1

57e717c265b58ca3bf18c4053a3bb2553346533f
SHA256

1c35e498b9ea169a3ac4fbb7b6fb63a84b21d8d85a9ca17a4b44bcc1c2ad18ec
SHA512

e538b1e733780bb559169340118811a6a37d4afab4a96495d5afec583e91b8ebb7beb225d6e64f1164989f787aa2fa8a0ac843992a9b50c2eb47d57f7c70bba1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4624 OpenWith.exe

pid	process
4624	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\APT-Hunter-master\Tools\HCTOOLS\source\evtrpt.pl
1⤵
- Modifies registry class
PID:3112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact