63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273

Analysis

Target

63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273.exe
Size

31KB
MD5

be66486e94874c679f64129b03d24d49
SHA1

8b123a37aa84be63c5c2dc7edde082c546a74447
SHA256

63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273
SHA512

854c19cf9b3bf831a258c031f11cea0cdda93f3f98930f52f3c2e4f52ebfa6221a5589c3e819502c0a830331d2c5156ca68be71902c5c14f4a006bb34e13222f

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1280 OpenWith.exe

pid	process
1280	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273.exe
"C:\Users\Admin\AppData\Local\Temp\63027d093681f243f42cf00064dc5952bd3d8f2ed3d26a48f5d057a612c92273.exe"
1⤵
- Modifies registry class
PID:4588

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/4588-130-0x0000000075150000-0x0000000075701000-memory.dmp

Filesize
5.7MB

Download
memory/4588-131-0x0000000075150000-0x0000000075701000-memory.dmp

Filesize
5.7MB

Download
memory/4588-132-0x0000000075150000-0x0000000075701000-memory.dmp

Filesize
5.7MB

Download