377d477d2942dac5b44137b7ac2a36e1588656598dc8b2b6402a80b7d7ee2502

Analysis

Target

projectrequirements.rsp
Size

30B
MD5

6e020ce75c33224bce1d16a78a6c1eee
SHA1

fefc97b219e4e561bc6a2f4d81de3906a75fac5b
SHA256

3cfa1e65becda265b065294d9ecb9b5b79fe155fc9d456f9061e4a395f814a14
SHA512

dca95e0c296ac5112f5150521d2892c8e4cdad20ae7341b1d3bc454d5839d0c3b2a425a445dc69a357c8da9a217aa8a45b804f47cdcaff4eaa010c5b2ea16633

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1156	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\projectrequirements.rsp
1⤵
- Modifies registry class
PID:816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact