5f02d11f87d53b8e02eb1a943c553c969dc80f57bad64fedd842b5607109a141

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:05

Target

EXEPackager/nsFLVPlayer.dat
Size

488B
MD5

4aa45509d7b7ff336a4f3368f4e896a1
SHA1

4aead3b6afb71bc18d8289549887c6b040d9f7cd
SHA256

a07c5b7e4cb2bf7b1f0cfeb21310a1614cad8af8aab114ff8bb02528894d5e43
SHA512

9d4d25795bb2a371c7af8ccdbf51691adbe0016041fe1834aac565a88d83c3c5bfd9ef9b547e4fa390b87b23001f451176094e92e3ced1f8b1b63ef61c3bab3c

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3840 OpenWith.exe

pid	process
3840	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EXEPackager\nsFLVPlayer.dat
1⤵
- Modifies registry class
PID:2084

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact