aefeed0c32afb5933a44c85ba14888058e58488053421c5fa86ffbe1bcf9efa8

Analysis

Target

2022-06-16-extic.icu-empower-type.tiff.bin
Size

205KB
MD5

314a641ee6ef932f4c561388bd539090
SHA1

f20a688766f3c7105b64a6342277879d751de6f3
SHA256

1e9aaf1375d9f7403644b4bea2c6fe679579bf61945ba6bdb54cc7cd7b728211
SHA512

2f6c34bf7bd616a5c5c5fbaefd1fe066a55af17cf599dd4cf2bc0d7185a0557ca38833f2ddbc58d32aa8a9ede2635ce4ffadb49e3f726e7d9ce080c2d1961d5d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2022-06-16-extic.icu-empower-type.tiff.bin
1⤵
- Modifies registry class
PID:2188

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact