43e47a037425c2efb68f0ba0004f7e851e8c242c5fa7ae6ade0e54fdd81e380a

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 23:12

Target

APT 37 Previous Commits 1/2021년 ICT융합 스마트공장 구축 및 고도화 사업 최종감리.hwp
Size

1.4MB
MD5

b8addd3c9e0c7f1ed8d4aafcb582e755
SHA1

680373d4873b13323a52854364f7564538d50178
SHA256

beea227a91e76e197f5f82c2d92a1b657a318c97ee083603be9f05cf21f85c9a
SHA512

b732dda231b261834fa303ed411ac34e638a03feb3c787efce47d9e1c6a89ff75cb364fce13ad4b7d30e64d7054d19cb4d78595a0b703f0592179136bbb0305a
SSDEEP

24576:VlFeF06suHGJqxEvDNWuk/EuAq6W1onwl1u1CMXbhoVjrDMB9Mm3L+Ije48rEbaj:V/eFSuHG0xEvDNWj/EZZnwyzGVjcBxLO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

400 OpenWith.exe

pid	process
400	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 1\2021년 ICT융합 스마트공장 구축 및 고도화 사업 최종감리.hwp"
1⤵
- Modifies registry class
PID:5092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact