498f9603409d00174689a77e3bd4e25093fc023924680460b1757017ea3eefa9

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:52

Target
??????? appdata.bat
Size 82B
Sample240612-3wpajswclc
SHA256 04fac8cb5297eea5cb8fb5f645d53682f429d5e4d86db62d9ff4106e88aaeee5
MD5 200aadbf80ceabc021f7ae98213cf3de
SHA1 5580580838d5fe9ea6240a2612e11ae7d070df9d
SHA512 3e80c5f11a5592bed69f463e1335acf685f5c7647758195e53e376257b0246603704baa4532a20715b80d31a70bf31b939fea78f777b958fc6ec79da6dba989d
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_______ appdata.bat"
1⤵
- Modifies registry class
PID:1724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3292

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact