aefeed0c32afb5933a44c85ba14888058e58488053421c5fa86ffbe1bcf9efa8

Analysis

Target

2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
Size

591KB
MD5

97fc6726f396c4b86bc84ca97e787637
SHA1

ad6e5024a0be6f69370e7a0482a2baa27c4a25be
SHA256

a5b06297d86aee3c261df7415a4fa873f38bd5573523178000d89a8d5fd64b9a
SHA512

52224bf00b3b54dfc74f64b7635a47fd065180c1df2afc26931273eb3b9784f11b09321686c371cf4fc9447dc693ae00308d5b6b285f290f9c65130b9b698a41

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3180	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2022-06-16-telemetrysystemcollection.com-m8YYdu-mCQ2U9-home.aspx-converted-to-XOR-ed-binary.bin
1⤵
- Modifies registry class
PID:3888

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact