d933c1312d76c6d5759adbe705be02a6496f9d1f7af83629d2203a0b63bbac1f

Analysis

Target

project.rsp
Size

18B
MD5

06c6c9e9f69b6ba4bea7dd172904ee74
SHA1

4e86f1b41630dbf43be2bc82e516317c166aef8f
SHA256

3b41f2bb928cb4ae75944da01bf3204dd7fda3f80ae1b800395656b70b53a4ab
SHA512

e5bfffa1cda707667f4ea389775badb69bf4542e243b0489d042d2a3b5c1eeed8ad098f240ddc029a4f7ebe837ca3bcd5532cf2fa0434477d5dc5245d1adb8f9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1296	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\project.rsp
1⤵
- Modifies registry class
PID:3112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact