4a1ae7cf9606365db8ea043516a7ea76f673e55f3165f9e3573e31bc3b4710dd

Analysis

max time kernel
454s
max time network
457s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 13:12

Target

7Q7ATX/p.mgc
Size

80B
MD5

7bd6915380aec15a32cdb9a101c662f2
SHA1

9887fd2810a46043a4799e79abdb1d8fedcb2fcf
SHA256

e8d7ecbfe7fc511d64f278280b84001f48bbccef198926ef4a6b23ec99b53710
SHA512

76eb0ac8177939c5a9ae4f25c928c396173247246ebe7bd33e633d5e7fd5b5c63e3c0d4aece3cab1bfa95aa819a6db39728269b966a7bfbf1ef5ad66894e0694

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1172	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\7Q7ATX\p.mgc
1⤵
- Modifies registry class
PID:6096

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact