21557ee16033865aae503b34894ffac3d921f6f17a4b1f11ca926092b315fde4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 13:47

Target

$DESKTOP/PassMemPhone.jad
Size

278B
MD5

40d997c13a2ba3bb6652f8a60df57f7d
SHA1

7c8eeb01465f6644eb27b263830e1154162e3edc
SHA256

e5a2012bbca0caa52c49d9db48736e8a922a6205d5dbae5618421e7b524c0cc0
SHA512

cc7540333eb1fe267842fdabd0d3a78ba918b54fba6a0bf09a0c9b6d62b82fcce5e7341dbe32c2a7cc88791a6a9d2f34dc8efaef394176977586b3f8cdff9eab

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$DESKTOP\PassMemPhone.jad
1⤵
- Modifies registry class
PID:2760

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact