eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
83s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2023, 19:22

Sharing

Target

trojan-leaks-main/AnCo250S.z02
Size

24.0MB
MD5

5df1203bb287ca15a9e913cec9ec3880
SHA1

1770e794fada020413beefcf188162394160b9be
SHA256

7d99de4ee2ceb3f1b04e12aae16f00923fd03f75e16abed8b8941e4d6d1e1eeb
SHA512

95c8b215ac7b2a6036965d4d5d31a854b0443a6b9cb339a918322b34ef2cf6a1ad014ff579178ff5ec158f854d1b2866dbb325ae4b0076698a7b328f4b0f97a5
SSDEEP

393216:jDbc9ROt8uvFD6QTqzln5OJnrV+ewzYDDm/QudNNpynZoeEnLztCPYQgHRia5Gpu:jvswbTqzl8RcewzYDnmPpQzELzAwbHRx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\AnCo250S.z02
1⤵
- Modifies registry class
PID:2652

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact