81623f0482b30b1a3bd4c6089681bd4f2cf52d421f4ed68022629009326c0ca9

Analysis

max time kernel
117s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2022 03:08

Target

CVQD68.iso
Size

722KB
MD5

207cf18903882586280962ff3ccbf28d
SHA1

915b97f7e6b279a099b9393466b37de1c9410eb5
SHA256

81623f0482b30b1a3bd4c6089681bd4f2cf52d421f4ed68022629009326c0ca9
SHA512

91f69fadc1da71738d264f24ffd4e3db56a38495c2261ff76768e8f9b3d2a63a2baacda0abd933c9307a73b50d4f8133fad727c56df7661a19d4da583aa6ce85
SSDEEP

12288:bYX/TGcg+w9KCSJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:bYX/TGckKCS30IAIQR3O7OjHHApc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4384 cmd.exe
Token: SeManageVolumePrivilege 4384 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	4384	cmd.exe
Token: SeManageVolumePrivilege	4384	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact