43e47a037425c2efb68f0ba0004f7e851e8c242c5fa7ae6ade0e54fdd81e380a

Analysis

max time kernel
156s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 23:12

Target

APT 37 Previous Commits 1/20220916093205755684_TSA.rar
Size

959KB
MD5

1531bba6a8028d38d36c0a91b91159c3
SHA1

fd022cda6f03897adae856b0d8544cc587132ce3
SHA256

79c0c48614379371e3da809c512a945c19f48b326d2d28ea1603fb394fb18e81
SHA512

4dca2fc7bb55287f2dc8d759928f6ee70c43d6949d86f21979f0dc618e5ad0f424c19d62b548ea96c0dc5b197b449182a79e5db017ef3cf6dc32ad63ad7973d2
SSDEEP

24576:wpURDkB8WgmwgDBkg3aX8asLIy5t4tVq/K8ksqQEIGCOx:BCxDBE8asLISSE/pPkIMx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4436 OpenWith.exe

pid	process
4436	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\APT 37 Previous Commits 1\20220916093205755684_TSA.rar"
1⤵
- Modifies registry class
PID:3428

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact