0efb201862f2e484e0366dc8bc7a46c70c34057320c1020bc8bf73d9e57a312d

Analysis

max time kernel
153s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 18:50

Target

Total Network Inventory 2/TEMP/PISWKSD008_F8B46AA0CD6E.inv
Size

83KB
MD5

babbb6d4cfcea95247086e931dd93f92
SHA1

fbe92010c63b40f2970d9e5ee83c45da623f85eb
SHA256

a6b66fc0da5e23cd88c351416e0a272d6d7619dff7ba159166214802a4dcd452
SHA512

e2789d869b190bfed57575d0efc5b7bfe757adecb8cc2c24edcfad23fce52276c0c51432845eef69ef633dcff70c46ed2308a1cb9dfd36c3f7ec366cb51cb875
SSDEEP

1536:dm8cWVTHCHvDuQ4mEsgAhSsdN+F9Vix4Pyo0OVS90/gPz/Rd:08cW5HCKkgEMdyobHCzX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.inv	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.inv\ = "inv_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\inv_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1820	1416	cmd.exe	28
PID 1416 wrote to memory of 1820	1416	cmd.exe	28
PID 1416 wrote to memory of 1820	1416	cmd.exe	28
PID 1820 wrote to memory of 1784	1820	rundll32.exe	29
PID 1820 wrote to memory of 1784	1820	rundll32.exe	29
PID 1820 wrote to memory of 1784	1820	rundll32.exe	29
PID 1820 wrote to memory of 1784	1820	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD008_F8B46AA0CD6E.inv"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD008_F8B46AA0CD6E.inv
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Total Network Inventory 2\TEMP\PISWKSD008_F8B46AA0CD6E.inv"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1784

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact