babb6603ef3db2a4394ad8ea40c6373245dad6604bee7481383acd003cf9f70a

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 01:33

Target

Contra (J).gb
Size

128KB
MD5

2cc322a27530f6aaa09a35b2f14aebd5
SHA1

c8b34b5aba3d448e357b59cdf106ee9b134713db
SHA256

8e765a4e381462a29632b7a3c5421080be3e8445e5913d7e904a8e80d688ca81
SHA512

7842221604dc4bca07b3f91e960f8139e7592a3bad9a6abff5cfdd16ca98fa9f0be63d6526af8f2515007fb9ce6187a8b80d4d221da0e1018b9f1c21dcc1ffab
SSDEEP

3072:iwUT/0b6vbu1AvU6Iv68mBdWRaic5xrLWrK/RNYKt:NUDq8UDLiHrarK/Rf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3608	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Contra (J).gb"
1⤵
- Modifies registry class
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact