b972b5c3f2d253aa1cbd1693b4cd2e224c14b490ea6cb6fffbab79e91ab58289

Analysis

max time kernel
99s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 10:23

Target

Nicht bestätigt 635686.crdownload
Size

332KB
MD5

2f01e339f1facf12d0c2eaa84e1fbce4
SHA1

026ca8ed7d69b2fdd43589a1c8bdf981f17bb2cb
SHA256

b972b5c3f2d253aa1cbd1693b4cd2e224c14b490ea6cb6fffbab79e91ab58289
SHA512

3f13f8d057739adbc3d001bdd0c1635a7fbbd1253f9d2455c182b00240a1516a7e5fc7c96bcc1db1f92a9704ad466917b0e64c20d18f7042fdc7451990734433
SSDEEP

6144:TKHS1X7Tmw3LRil1dNktzY8k3a0hAV0MhG44Q+ItH9awe0SiKY7RslxJ:TKOX7TmgmwtzhkK0hAO5QptEwFH7mlxJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3872	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 635686.crdownload"
1⤵
- Modifies registry class
PID:4792

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact