00e715ce64eb10038453c97389c966f1940251b4422bc488b782fd8af4c761ed

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 14:34

Target

RFQ10675000162Doc.7z
Size

1.7MB
MD5

2471e9d267119c5e303ac4ba7cf13806
SHA1

9a3bba80df896eaf7e7e3cd77ffb50a2ff1d2d6a
SHA256

00e715ce64eb10038453c97389c966f1940251b4422bc488b782fd8af4c761ed
SHA512

3eef3cb75acf7875a7d62ef88177ee6f0287f1022a50085dcb997e119a6c4091e539912e81bafc0f093fbf1867f61a29950aedb591e8a57103d3179171e31923
SSDEEP

49152:/hCphg4tRB+dFk6toKYB1j2Ca608LI/JoCROC:/hCpL+db2KmVgCI3R/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 5 IoCs

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RFQ10675000162Doc.7z
1⤵
- Modifies registry class
PID:3484

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact