7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d

Analysis

Target

data/java/javapayload/stage/Stage.class
Size

211B
MD5

9ba4719f65a14ce08344e016299645ee
SHA1

5f0c8580fd846c35aef1b709ea16fdb08af56571
SHA256

c0bdef98a4a29a70c34ca6b8866a50e9dd88924aea5fd2d62c9cfdf9aeb08235
SHA512

f0897f9afa4fc493e28c7a330c300c982bafa1f00f8fef3e328192dd60abe02f68b8d9a7528208e5cf257dd134785636445aad7c083e0483d0da3558f516bb93

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

952 OpenWith.exe

pid	process
952	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\java\javapayload\stage\Stage.class
1⤵
- Modifies registry class
PID:1296

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact