683abb021663dcd0b79991ae0838a3ad92361127093860da39f09bc255fda3f1

Analysis

Target

upload.rsp
Size

17B
MD5

b053c0e000f7e180373cc4cdd0b2d1a4
SHA1

1d630bae1c6fc2436176525f7979b0fac2c69fff
SHA256

318887f05b4e2ec26742ba1df615ff1e661bca837107a0efe24da0ce96b705f5
SHA512

c3edf015cf9b266839b6affb4f58173367606a91e438e792fed847dabf6b5a897641236e92d76b2502ee01c0e6340eadcb9aa6c81bf4d7c870ce2aef2d65d4c5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4300	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\upload.rsp
1⤵
- Modifies registry class
PID:4900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact