45ff00e7a848fdb2c5ecb5fbdf608c492c20fdf68ecbe12637f599ed0aea7f6b

Analysis

Target

June-06028_65-Report.iso
Size

1.9MB
MD5

472097d742b7a64531766ec22826bcad
SHA1

ef95618ef18e7feb5b0d0563a47acea38b03b94c
SHA256

45ff00e7a848fdb2c5ecb5fbdf608c492c20fdf68ecbe12637f599ed0aea7f6b
SHA512

3ff26d6c8b7a62ce902006a6f78e1aa5bdb6fe19dc008855f39df2a7de8f5a7ed50c2015dc3183c973ac8fd18a3c310dd9f8f90ce0988a1978226370ab9880c5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

1188 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe

pid	process
1188	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact