eb4a7d75e1661dc1d9e158317a788eaf1c280da115c0c78662d0cba514b1e59b

Analysis

max time kernel
109s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2023, 21:09

Target

Setup/Locales/fil.pak
Size

329KB
MD5

392cf9a00dc0bc33ddbc7657c0cedf16
SHA1

24c694ab66d9a2e6fe5894bfeaccd1dd561090cf
SHA256

00d42753b54df1ee98ee223f8e0f2af559d6861b8ff38340eced8a74a2822b7f
SHA512

6251ee72eb2602b3c29126e35f58469291add77e533c8a5c160489c33b099e12af820d94654dbcb2f4cdfeb780f4d47be5d268f485aca40461885e90d97be05b
SSDEEP

6144:w5pJQa/RHDQ277GI0x0cbJXqGtZ3/5YhhTAH9T8:w5pVSx9D5vS

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3064	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Setup\Locales\fil.pak
1⤵
- Modifies registry class
PID:4024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact