09bb049cc4eeb25cc5890fe7f776dc76a333bd0da2c1099672508880de547845

Analysis

max time kernel
50s
max time network
61s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
14/02/2023, 00:34

Target

まりあ [Maria] 純真無垢Part4[IMOG-182][60fps].mkv.torrent
Size

14KB
MD5

544377cce3664d9cf1fa40076d163692
SHA1

80698ed0326a65a6db6e39b3cdaf17a070566baf
SHA256

09bb049cc4eeb25cc5890fe7f776dc76a333bd0da2c1099672508880de547845
SHA512

27d7f5c2d3f166eb55efcbc0208414436c13b343dc8e91c17ca0a20d6fb04448f78c24aab6a9bc4156980cfcaaec3823dd0f5b32ef968ec695cc1ed737de12fd
SSDEEP

384:nhn9nQhjrpbUsCcNZHDSt/amozJVjbKvuRMFbxXrB8:Yh5TrHDmozJVCmRMRq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\torrent_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\torrent_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\torrent_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\.torrent	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\.torrent\ = "torrent_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\torrent_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\torrent_auto_file\shell\open\command\ = "\"%ProgramFiles%\\Windows NT\\Accessories\\WORDPAD.EXE\" \"%1\""	OpenWith.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4440	4872	OpenWith.exe	69
PID 4872 wrote to memory of 4440	4872	OpenWith.exe	69

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\まりあ [Maria] 純真無垢Part4[IMOG-182][60fps].mkv.torrent"
1⤵
- Modifies registry class
PID:2240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\AppData\Local\Temp\まりあ [Maria] 純真無垢Part4[IMOG-182][60fps].mkv.torrent"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact