95b2fda9f43bb360e283a1c049fd06c686646415a0e9ebd93943df6d76dddd7e

Analysis

Target
95b2fda9f43bb360e283a1c049fd06c686646415a0e9ebd93943df6d76dddd7e.dex
Size 1.5MB
Sample220616-xbzmwsbbd5
SHA256 95b2fda9f43bb360e283a1c049fd06c686646415a0e9ebd93943df6d76dddd7e
MD5 4fa48f514dd9d46e00bb33becb89f6be
SHA1 19148c24e53b6b04020acedae9f60eed4f9db943
SHA512 ea0c4dd811fe357429b735a6177d729469e72d68d45319eadfd1944a9caa4a0f341ee85e69baff6e86971de8ee779828e1204408c63acfb245fc68e62cfb7e3c
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4572	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\95b2fda9f43bb360e283a1c049fd06c686646415a0e9ebd93943df6d76dddd7e.dex
1⤵
- Modifies registry class
PID:4120

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact