2569392ca5aeb3de4dd45280021dc7be1b3aa7dbdd32006b28c9357f58a7cf75

Analysis

max time kernel
177s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 15:39

Target

Agreement_ZXY61.iso
Size

662KB
MD5

f4fb2257acae4a9787809b4a6174be89
SHA1

9aa5b8c7782ae874fcc4dd9eca4ea219a5210276
SHA256

2569392ca5aeb3de4dd45280021dc7be1b3aa7dbdd32006b28c9357f58a7cf75
SHA512

2e902d3a36d6d5e88e72ddbc9cbb9d67ea13f396084619e4ae3e3ca09d8a973edfaccc5dd8b59508a2fd8b6377f2f4a3c33750cbc69739d14e27b4b44ff0eef7
SSDEEP

12288:SNWLxwOQHy6E1YF7P01JSdCLjqa/9mNdMxgligH8:SNWLxSHy6VP0/Ssfh9mUM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4112 cmd.exe
Token: SeManageVolumePrivilege 4112 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	4112	cmd.exe
Token: SeManageVolumePrivilege	4112	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact