7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e

Analysis

max time kernel
128s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:09

Target

RJ01082861-PC/nw_100_percent.pak
Size

808KB
MD5

2b302df5126585962982c5f9173b0413
SHA1

0729dfa5fee344e5530528f35d3e1348cbe44a53
SHA256

295fc26bb067bb062897c7468d508c2007b1531b3b050251a3f73e408c6982b1
SHA512

5003aa447412f44f0e38cbabef0824b16a8de33673cfe30dc9d31d82075b99767a668760c6757911a264e2f52b8730ef818218134b9cc340276ca9d052653734
SSDEEP

6144:lK1KUa3mN+IK0rYvFJLKRQ8UnDwXw/51zxHcSgEal9Dxd0NvmxzaK1aaaDfTEvVR:8ra3ilUeUH/51LLEtuIjgRjict+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3468	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\nw_100_percent.pak
1⤵
- Modifies registry class
PID:1436

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact