0c495376f108dd4f61ae682296b2b6a3944e22e70672df2cb72afcd4cea037b3

Analysis

max time kernel
96s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2022 01:55

Target

HP35.iso
Size

996KB
MD5

eabbb59e07b56a9a347113f988217212
SHA1

866a2ba92b24418efbb9bebe5adda6893d8d66ad
SHA256

0c495376f108dd4f61ae682296b2b6a3944e22e70672df2cb72afcd4cea037b3
SHA512

bb9b8c688562fb64355c0f0bc4ad37a0fe2c98ed5a87b8a40fb15e70f8d1ef68ea31d6ce594306cbc41963ba09ad244c3cb9bf8e5397a503194e23706c49d0b7
SSDEEP

24576:OYHx4Yk7A4DUESxg9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:BuY0ArHVT4vJ3tXwwvwJwRwJZwSw5wqj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 1256 cmd.exe
Token: SeManageVolumePrivilege 1256 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	1256	cmd.exe
Token: SeManageVolumePrivilege	1256	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact