05b62b9e33d9a0de113c55bb550b7542444a4d6d9ebb5dac18079288b556cdcf

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 08:53

Target
b.dex
Size 505KB
Sample231122-ktrc1sca3t
SHA256 05b62b9e33d9a0de113c55bb550b7542444a4d6d9ebb5dac18079288b556cdcf
MD5 c47aa078f3171336d6db70373898d66a
SHA1 3b629439364d4ff0499568cb6b1bd6f44eb3f828
SHA512 665e7b63346d07337805879b6f5d9b97412d5acdd19ce27e131b07ec482c1537ca44cc4d5bff500772c352b0b1a631bc33817d14affb08f1f7b2f53b719236a9
SSDEEP 6144:GyyOwSmOT3/FrGPuOsfrJMl90ljNn8m/CbEcadJBIondYz3j0MMZjqHTtw:40mg/1GP3ErJO9g8m/CbEcaLSoQ6j+w
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4820	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b.dex
1⤵
- Modifies registry class
PID:3264

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact