e8b27d9776228fec69909096f712fcbf90cd8a335394e3791ac3be7cb37b3556

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 17:04

Target

sulphanilamide.yaml
Size

77KB
MD5

68acfc368c5fb4c1523bbe7894e75b9f
SHA1

1f5895cfab8a22eb55e077f04525dc7fd25c1049
SHA256

391bcd9c7df6e29fb4262be92ba02aab4019cdb138a3e5c962035db26ffc1f72
SHA512

7361cd7748d848aa9352fd4749acbe36fba02fe3ac2d8773cbc536011abf97fc90a8a2414c2b57eed90a86c5942201df0e2ef32c5ab3045fd0a1dafdbe896d7f
SSDEEP

768:A+s/A/Q9sYz7ObmTURWzr9dGA72Cv2dGFWrNPnDqN/acXmA2r+HbvD6h0s7BtlxM:FscXYejO/D8N70BE/7rimRS9OErr

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
924	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sulphanilamide.yaml
1⤵
- Modifies registry class
PID:2596

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact