77b4650847cb0c0389bcbe8feda2807d42d3f59cdd3f2b0b07f8dcc04e904fa4

Analysis

Target

APT-Hunter-master/Tools/HCTOOLS/source/lnk.pl
Size

1KB
MD5

4a3fad4d272736ebc00f30bfbc272afd
SHA1

7a0b558663b555008eb2f57ffe507057c071425f
SHA256

90edb61dea5961d463c19cd7c4b91649f170d67350d713b650be45e1a009b6b7
SHA512

89495ac26fdc7a0bde54b9d8d6956660c3bbbc18e095442a388dac1fbc0d3b7d7f3bd9ff7f2b4bed646f453fa21418cd34f35ffabd7998640b6fb483a8487288

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4624 OpenWith.exe

pid	process
4624	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\APT-Hunter-master\Tools\HCTOOLS\source\lnk.pl
1⤵
- Modifies registry class
PID:1316

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact