ee0c0dc46fce3803603995d998a1a09618f743e88bf26f3a256b5555a72ef978

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:04

Target

gonb1723/PayloadX.class
Size

2KB
MD5

47b5098471c111ef387c6e20bc829e4a
SHA1

eb92be183f1bc909748c43b2297c58d167c20a1d
SHA256

82f3f73e6395a64d778a274a23063c5b30350b45be4a2d00443c9fccbe8b3e1e
SHA512

e7587fbea6c1f1f41a536a217c274809c566519fc1fba4952b4df43b5778cde45d0f74c7fda9428b1fc3385411e93e75ddfd45d08ead71bd7ea95eb164ba39d6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gonb1723\PayloadX.class
1⤵
- Modifies registry class
PID:2380

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact