eb4a7d75e1661dc1d9e158317a788eaf1c280da115c0c78662d0cba514b1e59b

Analysis

max time kernel
149s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2023 21:09

Target

Setup/Locales/es-419.pak
Size

317KB
MD5

32b26b9afb8dd050c0dabf5fa3c5f787
SHA1

11d0336356a1469727642db8a78d793f7cbf886d
SHA256

5e3439226db55927497df667b37a37b7c7307db4973ee46d9415c1e337ed4820
SHA512

f4ead39651e34da95181cfe448dffee8e46f8deaa6b47926b986201ec089d6af9320477311dc1824f1e535f75813cc09194bfbf77cefe573fe5e08f46b88c0d7
SSDEEP

3072:y1I8rQvEO/A+HVavjTxjze0nL13q+YHWyr8dN5TlQ+sQRBzgm9M:y1ZRO/7HVAmEggdN5KQRBzgm9M

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Setup\Locales\es-419.pak
1⤵
- Modifies registry class
PID:4820

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact