7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d

Analysis

Target

data/java/metasploit/JMXPayloadMBean.class
Size

163B
MD5

085d95ceddf953cd94e138d0d8abce4b
SHA1

ef1103236a4701921b00cb30241db80791aa62d4
SHA256

89a2395fe23607c41f5292f6aa22565e69d557bf529166f7c6e3c2d89b6c41b8
SHA512

ff5ddf968437180bd1b017e8fc3adcc2468bd68b35a5001ce909d69d5a9ae670971342e034dbf459bd2856fcee820ad33f29a362917e3c6d05c7b6bfe44ba6f4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4968 OpenWith.exe

pid	process
4968	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\java\metasploit\JMXPayloadMBean.class
1⤵
- Modifies registry class
PID:456

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact