cf60eacd48c1c27cad4b9d3754e6af6c6a6770748b4111916c53eda44f73b9f5

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2023, 23:02

Target

shaders/hlsl/renderchunk.fragment.hlsl
Size

1KB
MD5

8b7ce9e48a63d3bde45d8236ee142382
SHA1

d5740c9ae9a9b18e5cc43147fcf0b6b89800adc4
SHA256

12c21d230e6bb56630fef1163ecf05d0201552fc25f4532d46507d172c04ab23
SHA512

6390cc958338412e717f01f52d2471a88d56856046939e744b61798dc618edc98b48ccad402aa4170ad49949447421a0afe53f18534575d046645c3c16fffdeb

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\shaders\hlsl\renderchunk.fragment.hlsl
1⤵
- Modifies registry class
PID:1304

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact