44381fa39c8d8abf32a1bda3dad6b9555930bf6d177830e155c3ca269593c217

Analysis

max time kernel
94s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/05/2023, 19:58

Target

iron_boots.json
Size

621B
MD5

9cab013cbd698a2abe743fcc6aad76ec
SHA1

8e29e34c8a5b6eb10c87428d39090af7b272b413
SHA256

5db1ee0cea28b33044cfacc54075053047523f21696a35f10e38e8c96db10373
SHA512

e485c0366134b37cf089e342b9bf6b463893207ecca0e5b821ed2be3321b0ac3500510763239b25312a8c80182a4492f35d9286dd39075dcc6e0ab21f02e1e7e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2984	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\iron_boots.json
1⤵
- Modifies registry class
PID:2688

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact