ef0250d8bd2afdd636bcdca3e55d135c15f18d1c18cad6502e1e58f352ad09cf

Analysis

max time kernel
77s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09/06/2024, 22:02

Target

教程/DefenderRemover.7z
Size

577KB
MD5

dd1de9b2f3fd46946dcf7c0e5d3f3ab7
SHA1

9ffe5ccb4ce146ad7e06718813b88626d5691b58
SHA256

b751a0a4536bb9e5d454ab74b021650479ab1a46792b2616968183589dd8abd5
SHA512

a9f9fccba3d4df7b9e77e625a94c8f708cd2ef856ce0530c81ac2dda424bcd90cc046d926660e5f5fdb4264c87f6ccf3fb92d4535dc7304e57dd1b53698369b6
SSDEEP

12288:Z/zIqzxKKVnRgq59fr/vLF6/hD90u9ngybChq6fvqAFmyP:JIcKKVtnF6/XXp0hzqAIyP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3192	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\教程\DefenderRemover.7z
1⤵
- Modifies registry class
PID:1252

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact