1ec6cb9514a55bd2b967d767f2fa5416c4cc8eec3723e4c28f52fdacb1207d76

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 18:59

Target

cacert.pem
Size

211KB
MD5

e7cf471ba7c88f4e313f492a76e624b3
SHA1

c9ce28427c32cc9144871b92eea0557f95c7d070
SHA256

fb1ecd641d0a02c01bc9036d513cb658bbda62a75e246bedbc01764560a639f0
SHA512

08cd35277bf2260cb3232d7a7ca3cce6b2bd58af9221922d2c6e9838a19c2f96d1ca6d77f3cc2a3ab611692f9fec939e9b21f67442282e867a487b0203ee0279
SSDEEP

6144:vcRqZx9NSaNI6Fd4tL52dTOgSQh1hV1AqZ:vc8nHW6f4tL5mO41hXAqZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cacert.pem
1⤵
- Modifies registry class
PID:4128

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact