21249bb0ad8b3391ebc28b1817037326c18f5b3d566e8a59de8f0d2d6202a6b7

Analysis

max time kernel
74s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2023 12:36

Target

Wondershare UniConverter 14.1.6.107 (x64) Multilingual ( 2 decembre 2022) by Keff.rar
Size

219.1MB
MD5

fc45942e0b9d0cfd175397c35f273015
SHA1

b2b85ea3a2829414acb75f7b3cb4b303dd9247dd
SHA256

21249bb0ad8b3391ebc28b1817037326c18f5b3d566e8a59de8f0d2d6202a6b7
SHA512

cde62dccfd2d893522286c490f5324e23acafcf438350de248010c91a0058b392f22e5dee37cdd1f5fb3ada242c02f5da40ae7a353dabde39d4c1c95bfc5feb4
SSDEEP

6291456:lXDORmOgaMLERcA3J1uK4I16pA+xK5pWM7EfaDRYBcv:NDAmOgDDA3J1uKXx+xyWQoaDFv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4280 OpenWith.exe

pid	process
4280	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Wondershare UniConverter 14.1.6.107 (x64) Multilingual ( 2 decembre 2022) by Keff.rar"
1⤵
- Modifies registry class
PID:3556

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact