ee0c0dc46fce3803603995d998a1a09618f743e88bf26f3a256b5555a72ef978

Analysis

max time kernel
105s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:04

Target

gonb1723/PayloadX$StreamConnector.class
Size

1KB
MD5

d9ff997c928010f79acab779d358ac35
SHA1

8d5bdcd4ce73f31ff250fcd0bfbf6ff311d7c28d
SHA256

59055cc65d8266391a51be47f2a8ddeabeb9a030e8fe870dae1b5b9858bfbba2
SHA512

9babb54a11998352c955463fabbfdc08ffc2549359f1d06a13fdf74f0ee99f01284ac79c7bfcf9c4b888ad79c446616ef22311779dec861c23b5cdf33288b616

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3800	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gonb1723\PayloadX$StreamConnector.class
1⤵
- Modifies registry class
PID:1580

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact