41f8177b4b441a17e91bdcb6f4d95cc0673cf8e71ee522f30cf5e4a44e28b0fe

Analysis

max time kernel
140s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 19:44

Target

$TEMP/A2451303/x1010109.7z
Size

226KB
MD5

2ece60cb284456cd0a454af87ffd9a1d
SHA1

09ab2a5730cd11814ac58eccb498df2f081cd4ca
SHA256

d4f56c1ff0aced689962630b157b3cb521f1ea3ead67240be77fbeddab1236c3
SHA512

59d4c5a6fbea36d76ff17ef52de0193d430b9efdf674f36493794ec92f825ab82f75a21448999d10453cee197855c20046f9370c5fc5da83d0654ddaadde3c26
SSDEEP

3072:ynHYXkr5HGhqYS/nOTQx4FbsxP8MlI9Q+lVxjC11/NrM3BmQrOo:LU5EqFnOsx4F+emQh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\A2451303\x1010109.7z
1⤵
- Modifies registry class
PID:4768

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact