437c8032e578d678d10379c25af38953c41821103fb2d7d25f6a229fdd2bec10

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2023 22:51

Target

Borrador/Language/Russian.lng
Size

7KB
MD5

f3601cd1c2fecc1b7190cbd724ced684
SHA1

8cf1e731050aee6afcbba0f32c81ed7578f0f41e
SHA256

84bfadabf7893eec7123b5f1ca41394d3a69d237b5f355f3f2ce29f1854888d8
SHA512

06e7c202036d5403e9da27884d04d216bd6b1b92b8d8b0a1caf105722d4668c2727be91fa5c8cacdf91aa838ec7408d5c0354476945e2736ce3437a360b7dd0e
SSDEEP

96:rRuK6ylCauTV1LM9tgAT/4TT7wTJMTAoY4Jp5Ty9w6g0hTqBTrDozW7DMXSUB9yN:duJywauTV1w9XTyTUTmT4CQkTtD2Hy73

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1108	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Borrador\Language\Russian.lng
1⤵
- Modifies registry class
PID:4204

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact