09b05c6c7f16211f86208d668021ecc8900d6d3b5c2dd449f7fbfe99f832cd72

Analysis

max time kernel
1658s
max time network
1150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 07:51

Target

Client-built.rar
Size

26KB
MD5

0d1810f13c1c5984d4777f347b85d5f9
SHA1

e977a14d3bcca98ce8b96587c9611971c0d7b859
SHA256

09b05c6c7f16211f86208d668021ecc8900d6d3b5c2dd449f7fbfe99f832cd72
SHA512

4178c8c409a4ac8db4c9dbcf1dd594712f643025241961c4d4a3b0de88a458bd29154b06ec9940681fe310b7d2f9129a8e5016519a506348527dc02446b2ed9a
SSDEEP

384:fW9YI/BNY0xjvRF8tmA2MXnd2F/v1gkRi5510OjvH+lAR0PpAHOzBEE+iPUmeKm:fWqgcA5CtmA2cd2FmhJGM0RAuz0i8mZm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Client-built.rar
1⤵
- Modifies registry class
PID:2112

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact