3a905e1b799c7d4f0d48179385081c3609de231c3b44cf31e86ff908df73e58f

Analysis

max time kernel
118s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2023, 01:29

Target

baseline.prof
Size

1KB
MD5

b6b9ff84244f548ab54347ed5e02ea72
SHA1

0ac6ddcb8c3aa6563e38de523b61962876430344
SHA256

3d8b9ad4152845abca8323d61098824b551db46d108779d6688933ab881b7cc6
SHA512

e95eea94bccd785e555c649fb6fe93ce0059ff4ef3baf88fe790431923fc68b606afe9df85995eb7ef9af7e828271fb1756eac7a708324c704e9892653579019

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4092	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\baseline.prof
1⤵
- Modifies registry class
PID:2972

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact