e95c2508bab20b1fb478a24d4c4a3ee75bec5e1b8e7a0c66928948cec30773cf

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 03:06

Target

happytime-onvif-server/happytime-rtsp-server/ssl.key
Size

887B
MD5

eff8ee8ab92f31a6ff9248389f8afde5
SHA1

f297b4a3818579ec1afee784fde47fedae3e9283
SHA256

e8bd36c6da7ee95fc86d4e28ab09d52e8006ec2b6ab8ee4aaf2886284d567b4d
SHA512

cb6667634ac3db95b2aaf6a81378d3d34d4b88aef621cfc3df96faaa5af901dfb54d25653099b6770f28231c25123a8731f02d3328b3b7233fe306e550747961

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1732 OpenWith.exe

pid	process
1732	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\happytime-onvif-server\happytime-rtsp-server\ssl.key
1⤵
- Modifies registry class
PID:1252

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact