97407f534fdc551ed2b568c7bf7b6df69c984fda5c03c518499fee4af7f6bbc2

Analysis

max time kernel
290s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 02:26

Target

af.bin
Size

16B
MD5

f46b47c070753ce74788b3e6aab9b51e
SHA1

e238dbd6d19b1b4e0313f0278aea834850defa34
SHA256

e1ca02031ff45be7314e3095c5a3e85c1370fc91b7dbf9a181d082f853507711
SHA512

67d20a325c412928c4286d6d6597a07297ce13d8897b4e77b24c0a7d73ad259630381ee9741e0cadfb4767e2d6eeba5e88367d460ccdf0bc5d0f2eca355d41d7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\af.bin
1⤵
- Modifies registry class
PID:4648

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact