46a3efabda1bf307c7139790762b8d0db1385d8f17639956edbf395ff21cc346

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 21:03

Target

3ca8e557a76dbdaf93395d77fc3890b5.jad
Size

32KB
MD5

3ca8e557a76dbdaf93395d77fc3890b5
SHA1

49e642dbe056dfdd7499057cabe07cde32c3acb3
SHA256

46a3efabda1bf307c7139790762b8d0db1385d8f17639956edbf395ff21cc346
SHA512

401ac6ddf0ac30f7ee81e855b1d6c2f73e1a1a78dadcc2d71a3d1f4deb7d0bb51ee1a7d4448f8a57c070c9aec00faa852c15718565aa172323a0dd753bfac3d9
SSDEEP

768:cQazjhKEv4D1QQzRoGvpCTT/SsIX7OqCzvGJdcIXO1:GjGRCTTFclCLM2Ie1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3ca8e557a76dbdaf93395d77fc3890b5.jad
1⤵
- Modifies registry class
PID:3972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact