43e47a037425c2efb68f0ba0004f7e851e8c242c5fa7ae6ade0e54fdd81e380a

Analysis

max time kernel
88s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 23:12

Target

APT 37 Previous Commits 1/20220510_115155.rar
Size

899KB
MD5

cfd73942f61fbb14dded15f3d0c92f4a
SHA1

23034186849aff6b2cd775b9e34d0a5d1f5954be
SHA256

6b912eeda69069fb6a3fa3cfc10db029e8ebbee936cab19137cad103d9fc6abd
SHA512

79599831de00047ee85d6a56be8dd8ba49915fa20be7607fa4cc7ea5f2b53517c4a085d0957fbf8deb838beae5a2a711b62bddc7bfe1f542c8cc9d435599005f
SSDEEP

24576:8uGP2N33OyhJ1zyYRTkQ2nI3Qh6Rv3uPiFlsfB:8uI2XbGYR4Q2nI3jgpfB

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1796 OpenWith.exe

pid	process
1796	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 1\20220510_115155.rar"
1⤵
- Modifies registry class
PID:5024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact