c5ae818f3e0fe518e0aaadac7b21ba6477943b57465fe2ded1717b7a9f1705b6

Target

prjct.rsp
Size

16B
MD5

4080b43f784d55b529bfdaa037f50789
SHA1

9bcde1ef9a7e3fb602572562ca11c24ae64010c6
SHA256

9d7cefe910724cecaefe05a417129eaf537cab95d198cc5b1f0a1d822e810988
SHA512

fd5a879707c13e4a0c324495f332a8277754f2c9af8b6470b976dd7a5a81858047035071e1c7abf4408729817afb6b91092b15b3297252fab04f6fd594ae35b0

Score

3^/10

Malware Config

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
548	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\prjct.rsp
1⤵
- Modifies registry class
PID:60

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact