8c5199635ca22fc6796557743d865e17988fc6079b1f4e797ffafa505c1af41b

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2022 21:42

Target

CVXR13.iso
Size

722KB
MD5

93fb4e67bb6e89edbce444f294551db4
SHA1

e0c89695dc6e2d287863f3a89fa064a3a1266065
SHA256

8c5199635ca22fc6796557743d865e17988fc6079b1f4e797ffafa505c1af41b
SHA512

407fa38c52562a208321d6c3c4ba1977d59cc3e419ee5e6aac27a730d56b1ac37ae2c5325d70f01c67dc9498671a26648fc6875d400f4003fa9db01504e15860
SSDEEP

12288:BYh/TGcg+w9KCHJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:BYh/TGckKCH30IAIQR3O7OjHHApc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4664 cmd.exe
Token: SeManageVolumePrivilege 4664 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	4664	cmd.exe
Token: SeManageVolumePrivilege	4664	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact