be8c72e77bd4a9453a3ffbf89383ca1487c650c3eb006b8c58e5e6490089b38c

Analysis

max time kernel
99s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 15:14

Target

BlitzedPrem.7z
Size

5.3MB
MD5

7c73dbaf4675062445763268ae30fd50
SHA1

6a26872339fc0cecee551c81317cd40fcfb30cbd
SHA256

be8c72e77bd4a9453a3ffbf89383ca1487c650c3eb006b8c58e5e6490089b38c
SHA512

93ac3e0594c1ecd17579e9dd52ecdbd47c68fdde7a9a2a362f82e3c13f4eb2aa42ed8072de4b21eece9c75a460ba8b2fb79d66acd55b3ab78e3b12ff91efb653
SSDEEP

98304:jbDchxaZZXeYfaXv/zEvWNk9Od2/pfFz2zy24/SU1xyhuoYIDhMKJYPg:vDoaZZOYe/4We9o2952OHDwNJdJX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3540 OpenWith.exe

pid	process
3540	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BlitzedPrem.7z
1⤵
- Modifies registry class
PID:1692

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact