18ddcf2eba0cfd5f1f79b36250afe9a8a03986c6b73cd55ae1aa412046d33756

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 04:31

Target

SolaraB.zip
Size

6KB
MD5

b15b5c14f0f55758c10373a4f6901e95
SHA1

7a0f29c66b2b5b387f9dd5ad71c8cc1827da6b2d
SHA256

18ddcf2eba0cfd5f1f79b36250afe9a8a03986c6b73cd55ae1aa412046d33756
SHA512

9b8c58543a5260d45c3d335d6531ba7ace1539f1e1a7e8733fe445846b80e9b8707d64156f701ed420e3217350ee1cacf24b4deafe784554bf88e33cdd31de81
SSDEEP

192:/RJ89IahZ1Ka3u4VyPbKY7OrqbcjJuFl5ctFQnfKM:/RJ89IahX/eo0KYKrUcoMt+nfl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SolaraB.zip
1⤵
PID:2176

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\DisconnectWatch.sql
1⤵
- Modifies registry class
PID:2868

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact