31f8abd2733ec75af654648dd022ce1a4d89512ef3340292d5a84acf64db4280

Analysis

max time kernel
128s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2022, 18:04

Target

[Kimochi] RJ436992.rar
Size

48.5MB
MD5

e9d50c096f7094eb52582735652e8844
SHA1

6b32291149b301220b4de48701d09f7220af2b20
SHA256

31f8abd2733ec75af654648dd022ce1a4d89512ef3340292d5a84acf64db4280
SHA512

01ce96cfb1b29a764fad346f28e32c35e378c99e237982c8e76d698464e67417ebf0b502fa6213e84bd9118e7eea6f17e9c934685e5909dc23273fd30b720c72
SSDEEP

786432:buzqzjbvMlaiMfsmiCo14VgED3Pd5jMFOf/jEz4xa6CRPsG4k5C5gzs0Z/xIhv/:bumTMOUmvo14tLDjMEw8s6CRRsS5ZU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\[Kimochi] RJ436992.rar"
1⤵
- Modifies registry class
PID:4320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2848

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact