829da96f3749a0a174b525c353de071ee8bae67655608a61a8bf83f06d791af4

Analysis

Target

sec.rsp
Size

14B
MD5

178205c1d8cc39f1e6a76bf86d791dc8
SHA1

215b7894b9680f604802b65381c58848ef3f17f5
SHA256

0f1419dcae5228bbe4f9305d5b265478ef5c618adc41540a637e08eb25f66429
SHA512

1dc4edb8c1467d5de639d9f5afaee1bec19edfab83f6d307cdbcb3870c22276029c92f06cb2bdefa1dab04c6f9009e5cc998cc009b68707ec92e59cd311eda78

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2716	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sec.rsp
1⤵
- Modifies registry class
PID:4336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact