be8c72e77bd4a9453a3ffbf89383ca1487c650c3eb006b8c58e5e6490089b38c

Analysis

max time kernel
82s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2023 11:47

Target

BlitzedGrabberV14.pdb
Size

69KB
MD5

5bd44240d711b107c17aa2915973dda1
SHA1

35389922775faf582f0141344407ee502f92bede
SHA256

c9c5dea39b8af57a992c993f4964d746ab3245903c443e17152b1606a46d0994
SHA512

2a2a73b51f25aef70a9971a07b0e9cf12ad45fc3048652fea06106c286b58cd35fae9cd606045f230d361702f289adab81bfb071928220300b2179bfb18e13b6
SSDEEP

768:lS0w1V6uLzbPmf9NsIBVUGHqzXHJCVOxE/mNcd:lS0gscrm1WMCGa36

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1256 OpenWith.exe

pid	process
1256	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV14.pdb
1⤵
- Modifies registry class
PID:4640

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact