d7f7749bde88ba1280b2e560778bab0234d40ea1a6f63dce8622fc2cc7271a09

Analysis

max time kernel
1227s
max time network
1231s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
21-03-2023 01:59

Target

Diablo.rar
Size

62.3MB
MD5

c898805fc52cc4cdcbab708ce689ddb4
SHA1

41781b91df67af1bc9b1eafd688ff3195cca2aa1
SHA256

d7f7749bde88ba1280b2e560778bab0234d40ea1a6f63dce8622fc2cc7271a09
SHA512

7e644b6b3ec7f59c41ca47ace70b233b94174331839bf8e32f8f81cfe79d0c6828681de761d4a8d2f4c510d63b51d26ec534ac8a7e90a81e061078bdc88b0fa7
SSDEEP

1572864:FBHP1Yqkw+B1lkVP+tqeozXwaxGfWCP1hadvKc71Yr9sj:FvtkblEP+tqZzXwkCP14KciBsj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2104 OpenWith.exe

pid	process
2104	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Diablo.rar
1⤵
- Modifies registry class
PID:1620

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact