6ef26a8ac83d7e17b484e7f3de0a66d5d27a32b0b48ed55517c2f6723b67d8da

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2023 14:29

Target

filedownloader.properties
Size

3KB
MD5

f763ad237cc9788bfafbff3a51ead551
SHA1

a8a011a79ae302dd05d6b07e1402035475ec3294
SHA256

c5c00932f73f4d8f47177c35ce2c122593f8de0a9f3cfc432cd76fc18881c7f0
SHA512

36eb23973c896959e7713ef6c83661ac581406b4d1486a8a04f3b7391a0ecc9b1101324e25ef1f7a9248f10a7906be28261c3d459365fc2755d7fcb2e1182a8d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\filedownloader.properties
1⤵
- Modifies registry class
PID:1188

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact