2950e686fd56d269a623a3e65b6d9d6e6e8c6bd0a20a7eb350ab84defc1ef7ea

Analysis

max time kernel
8s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/05/2023, 15:16

Target

Full_Active_Setup_2023_As_PassCode.rar
Size

6.6MB
MD5

87f21847b272fa295d2bba7530ddb603
SHA1

1d2bb69538214c056d78d2a425950492b88daa0a
SHA256

2950e686fd56d269a623a3e65b6d9d6e6e8c6bd0a20a7eb350ab84defc1ef7ea
SHA512

f27807859a10bef33e76fcdf6945021dfd258efcbbf6921a3fe4c5fe8d88acc43514dc2ef0461ed5aa5cb025990075b67540da14daed7341fe8455e2fe55ddec
SSDEEP

98304:R0DFsm6zLB/HyyQC4abCKWdgT/DFegrfEl8mU1nFCMAUdh80hE8O+seUiT:+D/6nJyhC4erX/D8gYl8mUnwUdhbZic

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Full_Active_Setup_2023_As_PassCode.rar
1⤵
- Modifies registry class
PID:1100

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact