9bda83f50f9b0ce654426894e1052ef03af3abbe8949bb1f95a00530f991bf4c

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 18:49

Target

bad.img
Size

2.8MB
MD5

57f2d662f4fc334a9d762da20dfc0ff1
SHA1

08bc7e498c21877d4003340f2facc537fb16804a
SHA256

9bda83f50f9b0ce654426894e1052ef03af3abbe8949bb1f95a00530f991bf4c
SHA512

2e3fbc8b4afec7b54b4c67c18511ad60cdf55cb8d7a596e7b7c80c4ebaa0f0533abf6869007018924f7911ae9cae6ec0833647b015bd1e70b733f91413816ded
SSDEEP

24576:dXU+n0v2QTc22HlYSpMU/3FHxX+1tPfmeCbB1hfW+vFmPDr:a+s2RFYUMUdR2tHwEL3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4160	cmd.exe
Token: SeManageVolumePrivilege	4160	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact