86dd5c4f5c19f4a1403c31548f0a6d72d23a4fc8f7642a9044712f6710cfe7af

Analysis

max time kernel
131s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 03:48

Target

Needy Streamer Overload [FitGirl Repack]/MD5/fitgirl-bins.md5
Size

196B
MD5

572083e346ba2f42ddcb2f99e45d7b6e
SHA1

2662e1aea649acc4ea2e8ee73fe0d336f3ae4c63
SHA256

57ca17a31276aa64a998a5ac4eb906ff2832fe772ef979d8d70c510f5b4892da
SHA512

54ea56f709b609c898df4a346296f818c7452dbfd5e05c353a8f5b562ed8184a55af966337e6439171413c1252461d00808128e0e39a9c833a78a6e9e40bd0b1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Needy Streamer Overload [FitGirl Repack]\MD5\fitgirl-bins.md5"
1⤵
- Modifies registry class
PID:4468

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact