bd5efd35e27e38b2c97e9376ed3bcf13ae94e38da6b3667942c363d5a4a77279

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 13:56

Target
settings.evon
Size 153B
Sample221005-q87w7seeb7
SHA256 bd5efd35e27e38b2c97e9376ed3bcf13ae94e38da6b3667942c363d5a4a77279
MD5 f78fcadbb0dace28b89357577c6ccb52
SHA1 c29973ca4911fb9d27a6774752ee1fbbe758a65c
SHA512 77ca267b694c830865858702982321a8546ba39fd79b4c8d7f516c8f66249dffbfe339b6aba4dc6f6d8605343f067dca5ee9313987ee2ed4db1bc3e1c20310fc
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\settings.evon
1⤵
- Modifies registry class
PID:1516

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact