b3c5e464e43d7db2432f3e28de75bd0eee8fa7a2b7b6fef7134e7115d6681be3

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 14:35

Target

$RECYCLE.BIN/$RTQTF65.vhd
Size

6.0MB
MD5

fd4979108b9587139173f02f7f0e6797
SHA1

6db7400102360fa2644e003eaeb96315d041c36c
SHA256

e1d549111b59ebb819d83440133ee876947261f3e8c2a78594de228a77de1b8f
SHA512

52f2fb184bf01ae3b4459cf4e54891d0efe7f24b156d98f897709c9108a709d7e2bda545fdb3cf34bf07f0018d94f1e9ed357682f513478064b434f6e34d951c
SSDEEP

1536:C+PCBK4J9mILDGlGC6H9S5QZ9BiLJfhHB+ZVBGIg47x1eDBSMi+1WSxlul7W4iui:JlGC6H45QtiLJfhB+ZVBGIXcSI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RTQTF65.vhd
1⤵
- Modifies registry class
PID:3516

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance