5460893e1821a49d48335a34e7e4116bf11d8b74bbb7462049f1aafe0dd50e79

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 09:50

Target

ILrHVwddXFWz71.rar
Size

208KB
MD5

edfb8e4492d0f9766c021010db96b5c4
SHA1

75d28ba425a37e3ac3186a98cc6e3f79910c78d4
SHA256

5460893e1821a49d48335a34e7e4116bf11d8b74bbb7462049f1aafe0dd50e79
SHA512

86e57b522ae2e560b1a74b33df19893c61e8de7fe11ec1abf89f1597c7fa43022969b1d87ffceb96c88b16c314b56c274f7e0c5fb53eb4f6bd43fbaf96fa4457
SSDEEP

3072:Wkz/A8GjTWgr1VQM8BIoCG0RhWakz7edZ+BbaWCQapjRIVyP2EZWwu8U+lq/P+:7KXr1VQMFJbRX+Ka5PLaFihEZWwhR3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
368	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ILrHVwddXFWz71.rar
1⤵
- Modifies registry class
PID:2232

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact