babb6603ef3db2a4394ad8ea40c6373245dad6604bee7481383acd003cf9f70a

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 01:33

Target

GB0029.gb
Size

32KB
MD5

7f1e1ce56aca694b46da2ba407b60cb3
SHA1

211221bd34b3ae86ce5d647a81caab8bb91bfa71
SHA256

ed0ab3bfcbc6ac96cc1c8eebb9cdabf0c52e1a562d115eefe47b2078746bc691
SHA512

6c92cf2769055923edcedfd61a8b413dfd5270a383afe8637b0b8ea12ae5aa6b93748199539435200bf25398f691cf8806cd18e74e4fd2de2518507708af1a0c
SSDEEP

768:PP+2nR7+sAy5DL1dDsF3uTSAIdL0bDKZGNd:Pm2WS963kSAfNd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GB0029.gb
1⤵
- Modifies registry class
PID:2344

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact