4e1bef93fe9a274fceb49e68298010781f952be7a526f2c34b42a0e9de100d6b

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 11:02

Target

QE74.iso
Size

970KB
MD5

b97066193dbf3f493d37f63881ffda09
SHA1

2ca4aaa6361e37768ef025e90b800af11b02afc3
SHA256

4e1bef93fe9a274fceb49e68298010781f952be7a526f2c34b42a0e9de100d6b
SHA512

5f31f4e1e0cac2121b0745b14b5e6171e21675eb1f0d1a7194c9e79eeec4729ec983185296e7c445b5876273e925e7c7d1e1274e7316caca093001dcec59451a
SSDEEP

12288:xocKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbrmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:xocKw9o6F+DRt4Tr8lkBhXp2QOU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4936 cmd.exe
Token: SeManageVolumePrivilege 4936 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	4936	cmd.exe
Token: SeManageVolumePrivilege	4936	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact