721499ca6fad05166c13e6748429c80f87e3c447915c60291e6aee557fa9b702

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 21:42

Target

uninstall_tool_3.7.3.5717.rar
Size

5.2MB
MD5

b28b23ce0608c5a2f0604f1a84a32ad4
SHA1

03ff535df8de72f10e2b7ccd2284abd904b28bcf
SHA256

721499ca6fad05166c13e6748429c80f87e3c447915c60291e6aee557fa9b702
SHA512

fec148a16c2a45ed40bb444ad8423b8a740ca0d624a4cfaa7b39c3a02937faa683d82508f92bc6b042081488b927a9d8893802ed105c2aadb3aab5c2c9233976
SSDEEP

98304:oHAB8m73KU71rtnkmP7y8FAPQS6s4KB/dw/knTbJger26aLK0uqoy1PsBjsH:oHVankTniKB/dw/kT1C6aLK0hoylIW

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
648	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\uninstall_tool_3.7.3.5717.rar
1⤵
- Modifies registry class
PID:4324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact