550321da5b10c472bc719bca2c0df74b240f80eff828079eb5253598fe112ae3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 15:33

Target

SAMP/custom.img
Size

8KB
MD5

8fc7f2ec79402a952d5b896b710b3a41
SHA1

8c2dd82d07d41977946eb12225e017d08ff19d81
SHA256

20de16a9abe3b2bf6f9fa415d855230a9c5487433b3c77037c2ee84d5f35df38
SHA512

803b6b2bc09782794cc2ba2929eefbc7a6304d7917f2fe8aabdf30882a05d6c8ef47fd0369782d6a0167f51e6371d372372362e8c10b73c274101b636b2a0aec
SSDEEP

96:Dp3y/CrKs/+qwbp3y/CrKs/+qf/M5k5Yk5x5x5x5x5x5e5b5w5k5q:t3y/CrPY3y/CrPf/qCYCfffffIV2Cq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2268	cmd.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact