edad632156bda5377a3ba4599816e88c85d5059411e3fe556bbe6a33dae0d178

Analysis

max time kernel
388s
max time network
1821s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
04/11/2023, 19:20

Target

Rise/Rise.json
Size

18KB
MD5

aadcfea6a724f892a985ae89b3ad1a27
SHA1

7a06dd3925caf18235405f1e3ebe8dcd3eb51a7a
SHA256

d50e83e987ceef4d7704c7224c85e6e27417af352ef49e651bd9c3632a19d24c
SHA512

1abde282a58ab0b122326aeb2262ca46e00bb1433cba07217aa2c0857dbac0e4722586b16c375f19b7b25c80dc72aa26d4e2f9e7c39423b57bd814c075ca004b
SSDEEP

192:o4Y0WahfacGfa9a+aFCaTsyvasBa0ac1b9aHWaca3aoca8a5azara8Da3NagVaUB:o4YkGz1bqJynTaw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rise\Rise.json
1⤵
- Modifies registry class
PID:2532

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact