c0747c10be35b8c1072a360c7759228b17f35d2ec890154020c716d572b00fbd

Analysis

max time kernel
495s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20240419-es
resource tags

arch:x64arch:x86image:win10v2004-20240419-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
26/04/2024, 22:54

Target

CITACION DEMANDA/riband.ai
Size

653KB
MD5

e299bc66495e5c7b49a74c9b10fbf57b
SHA1

afe89b3a5ee00ad81f914231c57bbb964af0b8b7
SHA256

21387648cc4294cbf149f7b3b34056e4eaf03260ad19fb9423ab87af820fa557
SHA512

574002417bf17d1884f7b009531c16467f233b9f32064bb8b229a98336c9038b8ca390d76f68051be84eb5bbd6949df0f81888aa7c3a765762c1966c1ffc8310
SSDEEP

12288:8QceuGVPyCtDjyQqjlsxNJnatgz+RFJvrllMC4pWnN9J9eAZ7EczfW6ZtW2Z:f5yOn+2s+4FJvYC4SeZ6ZtF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CITACION DEMANDA\riband.ai"
1⤵
- Modifies registry class
PID:312

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact