0efb201862f2e484e0366dc8bc7a46c70c34057320c1020bc8bf73d9e57a312d

Analysis

max time kernel
141s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2023 18:50

Target

Total Network Inventory 2/TEMP/PISWKSD011_F8B46AA336E8.inv
Size

94KB
MD5

6b397d7282a5a1b091c331274913a15e
SHA1

7dc43a9c40c74e1f5e93dea24f846bb0160ba2c9
SHA256

d4bd8f84ee951ad352e0ae73660529975c13555d4f481f6a8f07b943524b7c1c
SHA512

5674c9f87328151c44abc5aa21c2835ce59b2bbfb049d1c901a557b5b6dd3f66879f7316f0904b5f28cf8cba561b1b1a3cdf95e603c76795bcac727b74edda7e
SSDEEP

1536:ct+2jYu0PJzjNBzDsh/nMFHlqtaGP+5dppwhHgFwHImHCt80goVugruseZ9x0D4U:aLjYuANBnshfcIbP+5dh4zsvYgrY/eDP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD011_F8B46AA336E8.inv"
1⤵
- Modifies registry class
PID:1740

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact