7c46038c39d5e574738069256bc30cf86675bcabea0905b97f92b8be1bffa58d

Analysis

max time kernel
496s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2023, 01:12

Target

data.win
Size

206.6MB
MD5

2413d9da384f8d0ee4e2f2284663ecba
SHA1

701e740b89d4305e0bc491c8477f44999869c16b
SHA256

3996940b4df8931e5d54d6caf4b4afb98f0f9866fdf584fc9a0b01baaeb49d0f
SHA512

5137e107b2de176bf364d06d29c025f380aa06dbb1d48ca49689c39ffcd7f020f18a0b97172314da2df8c105323d882a9a8f1572ab01a0204e873086c46e63b3
SSDEEP

6291456:HxIH1baWonxWaVN7qHD0awRuV20fiXn8P/8O4SOEY:KHJQn4gqHDjwRFLO4vEY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2212	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data.win
1⤵
- Modifies registry class
PID:4992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact