692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d

Resubmissions

05-06-2022 15:10

02-06-2022 19:49

Target

Document-1310.iso
Size

338KB
MD5

ba10e6e571578304126a889202571e1b
SHA1

4a5d5a50503bc96e50b103981f05373982ecf307
SHA256

692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d
SHA512

aa0971e9169786e65407aae13a05b23710abda00c23d5103434ac655183670248a19736153c2528661f6dd7fcf46bc03df2c9264b84e24464aaa7ad916f6c40b

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

3632 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe

pid	process
3632	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact