b62ba92718d40eeffe0c3348f1e81d625beba92a6dd6d069625ed5261d5199b1

Analysis

max time kernel
303s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 19:02

Target

Pizza Tower by Igruha/data.bin
Size

177.7MB
MD5

0501b82ba18979b41bef8120622b1ff1
SHA1

1133d643c1bb26b195c20957c60f815d3a1ec514
SHA256

d414321c6e8986645376550c1c41faa579baedb7f6722ac53843f52f43f75948
SHA512

8a35e02cf1654af5c7defff44dc209fbf69f2b90aafd3774919d46b2d3d072349fc2bc2c5f140205b901d79f674aa0105327d20aed784181b15a0837d0c6c5e6
SSDEEP

3145728:Ps6qxsJHCxqY0PeC5BWhaC+zIYVG9ziKv43dlc8SZklFEst+iXC7b:ktxItnBGaCwIB43da8SZklFEq+iO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2656	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Pizza Tower by Igruha\data.bin"
1⤵
- Modifies registry class
PID:448

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact