fe1e0fda65567771d4bf59fbb26a7c87ae0da1a1792587229ac65edd9d95cdc2

Analysis

max time kernel
115s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2023 04:22

Target

stage/99Elevator.swf
Size

34KB
MD5

f9004e8dc39f5496952f60f901815dad
SHA1

08477c1b31f8b2c337c0516fee001d126906ecac
SHA256

6110168f58d01fed1e5f54d0ef9fac1ce80be9c36d241488d7a61f20289f85f1
SHA512

932ecf514cb4ea2c15ebfe081914c67228eb03d4cc62a09549ce084bee427bd9650f124eea057bac4c6435453a07ceac7f5b96bfeb738d7ff90450a99930f62c
SSDEEP

768:Ekmkc3M80ZnZC9qO3itFzn8vDk/E+y4vD3ybzK4Le7g9:EGfnZC8O3itFz8vDk/TyBq4y7E

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3092	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\stage\99Elevator.swf
1⤵
- Modifies registry class
PID:4772

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact