066e6c20ef3f17c91697bd34c9ad89f800cffb441be935540370d6009f0bb869

Analysis

max time kernel
447s
max time network
1169s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
18-01-2024 03:26

Target

6E6B6A1E-1410-487B-BD01-E03F1EE9E171_20231220T021429_20231227T101108_2022.1017.1801.1936_rs.json
Size

16KB
MD5

67cc4c4e47ef366aea8323c3eda04270
SHA1

a009837f22e4e1fa98d944030d66e756a16069c5
SHA256

ed5d6dfbb3d4f06d317b070adb6c30301e5748dc668bca2bb421b4260b3bae5f
SHA512

db39830589c9543eaf428ba096d3e0540197a283b3064a7339c1179e02cf72fb818d5c9f227a1bf50981f367a9e7696088435d8df20c62a4c4ca3707123fe951
SSDEEP

192:nNPYDV8UcxKEXUw6u5vLgROp5YPa6OZtpL34ztz79mzUAh4RIkz4yg8lRw:CDVnLwNjgMD6OZtYg8lRw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2912	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\6E6B6A1E-1410-487B-BD01-E03F1EE9E171_20231220T021429_20231227T101108_2022.1017.1801.1936_rs.json
1⤵
- Modifies registry class
PID:540

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact