2340b99b468fca3e8ad2c6a0909e217d3ff4a7c2bb0a5e770b8cc25cafcabd2f

Analysis

max time kernel
53s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
01-03-2023 17:45

Target

Suicide Guy.iso
Size

105.6MB
MD5

793453ae7ab009bb5c1d7a93f704ee03
SHA1

483ff24adf883040f5e64e417dada5ad9fa2e550
SHA256

5f647ea198fa8676dd0cd3443b0455a993589c525adc30887d66ffc7fd961939
SHA512

3c517c6f59e6fee6a28a43e78670addd41a3bf838622c2d65b691bc9296b4e72fff3f86c202036831321664548d55d9b62719df8d25378c5d59caf9d64537191
SSDEEP

3145728:hcJsHUY/d9nY5RVirUwhwAK2qo36nDpkmRaOtD5l+IAoOK6:eSHFdlY5Hir3hoZkmIK5HAoc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4604	cmd.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1356

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact