ae7215f849ff70a563174c591113f27904d41ba4ca612a840a87b2fe3bb2aead

Analysis

max time kernel
177s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 03:18

Target

cardGamea/cardGamef.class
Size

2KB
MD5

a0f427090ec7ac446835185b1d419b13
SHA1

a2c83175a86e83aebbd52e3c027a1c6425027de3
SHA256

6a204ed3b5d87ee835e867b8a01cf9d823efa0b91fb4594a45d4898acdc3565a
SHA512

ee6ea9101dc44b48e43260c84d6c9aa29947fb58555c5af70c6edd3ca2d95d4189634bb75b3ab833df16fe1278bbe8bb6598de66a84dbbe9ffd1643fe4938e22

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3472	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cardGamea\cardGamef.class
1⤵
- Modifies registry class
PID:1180

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact