a7e4e003f9088dbfb586a339f9b8943951edea7b319392e698fa2a063b7fefef

Analysis

max time kernel
54s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
14-02-2023 07:56

Target

btcr.rar
Size

9.5MB
MD5

c6d8d70396f84bbecbcfff529206cb74
SHA1

2eee5191a7e5d83d2f7954873b001a829fc3d629
SHA256

60e8609e60e6fe98d3298205aa5c48a0329fa2137148aaebb6c0cef88f0d32b3
SHA512

8286ff73572552989f1d3fac4537d9c04c7da3acdd7317d801b1b9c1312168c7c1d922dc901ab259ca8099c2016510af878a2e19d4beb69b92f5f9d7e2277018
SSDEEP

196608:cd5NGiTaz2wJ0FOo+rzxx9HjpFOUyw5B+jmRrvdIZGfiiPwEVqlZ/N:knazxJ0Fy3L9DpFOJw5MyRrFIpiP6n

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4708	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\btcr.rar
1⤵
- Modifies registry class
PID:2748

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact