e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
339s
max time network
343s
platform
windows10-2004_x64
resource
win10v2004-20240412-fr
resource tags

arch:x64arch:x86image:win10v2004-20240412-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
19-04-2024 18:08

Target

Celery.rar
Size

10.1MB
MD5

6a25ad9bba38ea7daa915dab03094ec6
SHA1

8c2c9569f97873a13fee7452aab49750b5537f22
SHA256

b86db6286fa6dad23bc1ba2695707861b25d7ca1f47e15a673897ec8619c4a69
SHA512

74cea880562f6265c24f5e3ea82f9d56edbe04a3151776e7727da3a5984ed458bb87c85f101e40f67599b44b3b5283f1ca6800f550e673e72d9e1d9d0605dba6
SSDEEP

196608:OJ2DBByvudpFlcRpeCDWxGzBP7KADoB1UymJ2XRtG1eLqgox74W:+SIvWxcRcVgzJuADoBOkXRoBgJW

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3568	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Celery.rar
1⤵
- Modifies registry class
PID:4516

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact