65e54bf481a524882973065280be9dc5bd057fe3f8bb9abeea8a74d9d1abe418

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2023, 15:21

Target

LC 1.3.1.rar
Size

12.2MB
MD5

9d6fbd2af8e7c3e705b975b67436d914
SHA1

3c5b21ce405a8df62dc377f7f7a9912678136b7f
SHA256

65e54bf481a524882973065280be9dc5bd057fe3f8bb9abeea8a74d9d1abe418
SHA512

1a71667a856a7df4d78610c6184eb4d7478f98728326db481040b72420b62c8baa82ada633a8aaa690ed228e61a471e2d692e9f8c659c87afcf0d1a88bc55ac6
SSDEEP

393216:zdlh2rpGwGKO6098WKKjcJ1R0PDmZ26JC:JbKEKO6G8WKoD4JC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
376	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LC 1.3.1.rar"
1⤵
- Modifies registry class
PID:1084

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact