9a48990bebc25b16ec4289702ce64135de6c1c2682b95ee74969f6d6a1266bb1

Analysis

max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2023 07:25

Target

adcsv.pl
Size

4KB
MD5

15cac1afbbb09047de6e032d18a4a878
SHA1

f21ed5a1b07b1f1f14f74caaa2867f4434fd080c
SHA256

cb2c9da00ca544cfe3dddfa491cb97a7d6da8e3b00e17c00a78c13c47c0db8b6
SHA512

07f39b8ea1a47b302efa6888f4145ee413c4d345aa3681df03673b82c12a11fa2b433b96c64850a9460829ed0c4c6b85741743c6691da39596544edecc5e9baf
SSDEEP

48:YzvgMmmGFPU4FYsTZz86v+LOQTS6CHT1XCbcUXoHWF555KlWmyQj1dTg:kvgMmmGW4FN8A+LOQdwTwbiS5SLk

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

5056 OpenWith.exe

pid	process
5056	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\adcsv.pl
1⤵
- Modifies registry class
PID:1912

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact