1d5550a21ad07ce2b2916954ed7951a80907aec0a0600a7566f9af51d0ee05ea

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 09:48

Target

RO-exec v2.0/configs/autosave.cfg
Size

971B
MD5

3386ac6b55f3addf304f6e1cce51e7ca
SHA1

a7b4690e696a4d3721f6593a69cc1803ab5cd55a
SHA256

c90eef14c30d70d78bcf5a6fb1ede83befa1a7a6259f72d2134a63fdd65550c6
SHA512

794a276919ccb64733ca4a2568cb8befcea6e14f1e6e4af3100b668c87e45080860a3caa9000a28f9950a8d25d22ef67e79b26b642824e0f2192d7e6ab5cada9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RO-exec v2.0\configs\autosave.cfg"
1⤵
- Modifies registry class
PID:5080

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact