0efb201862f2e484e0366dc8bc7a46c70c34057320c1020bc8bf73d9e57a312d

Analysis

max time kernel
154s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-05-2023 18:50

Target

Total Network Inventory 2/TEMP/PISWKSD012_F8B46AA41F16.inv
Size

93KB
MD5

1f4ffb4859403d8a542819fece712faa
SHA1

8073861028d7f70573762851a3faf1d0243cf065
SHA256

af01316740edf9edc43b7f236e5ad70361ac302c98e99e58d4b73b89b938e7f7
SHA512

781d301c422c2560cea9dc62cde3239ac3d61d596894d6ca844ccb190eb60be22d01c43a909e74038362001778fde1f8e7821927eb7eb4e34719b745235de636
SSDEEP

1536:liSQiL37O3jDXsk3qeHef0iK0CobkceoUJ+ulKgFysBOBulOIHXs:lpL32sk6+LjcRuQgp5H8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.inv	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.inv\ = "inv_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1044	1740	cmd.exe	27
PID 1740 wrote to memory of 1044	1740	cmd.exe	27
PID 1740 wrote to memory of 1044	1740	cmd.exe	27
PID 1044 wrote to memory of 464	1044	rundll32.exe	28
PID 1044 wrote to memory of 464	1044	rundll32.exe	28
PID 1044 wrote to memory of 464	1044	rundll32.exe	28
PID 1044 wrote to memory of 464	1044	rundll32.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD012_F8B46AA41F16.inv"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD012_F8B46AA41F16.inv
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD012_F8B46AA41F16.inv"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:464

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact