Analysis
-
max time kernel
90s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
04/05/2023, 18:50
General
-
Target
Total Network Inventory 2/TEMP/PISWKSD025_8CDCD4469BF1.inv
-
Size
461B
-
MD5
a5ec8d21316ce6b8c54715058485d554
-
SHA1
e76d1f73800e761c51ecd3a56e912f83d119a77a
-
SHA256
4e0a1119ce960c58e2da8c7df654daf39da1e1e0c0393480a00aef7c6a315bbc
-
SHA512
dc89d413c1bfc79a03864e3d344ae9ea02c2ace070118bb57aba73790e50fdc8a2fd3e73dcbf120726085a19a5bf536685941df2fab4e9938972af7a514b9727
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD025_8CDCD4469BF1.inv"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx