2236228c63130abe6bf0af76fdc1766a1833ecd88eb1fca3120385681e4064d5

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 16:58

Target

ZIP 0eddb3ce932ae8d912927a735f5ae1654d3d2ae675297149515f51e90fd6c69cf28da3f505dd3e9f91abebd03f1aa19b.rar
Size

783KB
MD5

28d401d312118b4b83f903b4e92195e4
SHA1

2349e32dc36c14f7a1c49038dc0195a6fc0e7c73
SHA256

2236228c63130abe6bf0af76fdc1766a1833ecd88eb1fca3120385681e4064d5
SHA512

ee3e9347f8e55b0ab60fade5cd0e8232ec23f825a8cb5288e0055f81186b04dc956b02a67086629d1674370dc91f0cff589ec57a5ad15d74bb368ce28e1fd69f
SSDEEP

12288:plW/ibueyAHgaC/6SMj1dtK+TiiUufJevxWAmpn+x4gtaKLDG5woonNfkx:OauewaC/6SMj1dtBh9eZW/8xhha+Nkx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 268	1992	cmd.exe	29
PID 1992 wrote to memory of 268	1992	cmd.exe	29
PID 1992 wrote to memory of 268	1992	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ZIP 0eddb3ce932ae8d912927a735f5ae1654d3d2ae675297149515f51e90fd6c69cf28da3f505dd3e9f91abebd03f1aa19b.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZIP 0eddb3ce932ae8d912927a735f5ae1654d3d2ae675297149515f51e90fd6c69cf28da3f505dd3e9f91abebd03f1aa19b.rar
  2⤵
  - Modifies registry class
  PID:268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact