ebf3e7290b8fd1e5509caa69335251f22b61baf3f9ff87b4e8544f3c1fea279d

Analysis

max time kernel
125s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2022 18:19

Target

pinrules.stl
Size

17KB
MD5

ffa4c0dd7b7601ee3ac59cee61e0803e
SHA1

167e53131eee30c41b28d466a7af835368289867
SHA256

48ac1b4059632ff4e41215da733af9d8e4e506fabad0f13e9b03362687cad9e5
SHA512

332fe8cc86e950d87a25b2af947836ba0eb9ebe46c1907b492f9e0037034e7d60af1e27484d96d32ac575ab52b4e28532b3c13467d29b291f1f51bb706567cc3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3464 OpenWith.exe

pid	process
3464	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\pinrules.stl
1⤵
- Modifies registry class
PID:4404

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact