03c83b3f458226a90a644b6894608c3d46c59cda2e62fd8654a7bfb1af241d36

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 07:24

Target

New folder (5)/GUI/Frames.iso
Size

820B
MD5

66d261cd29d603d80d19c4164f983fe5
SHA1

f448bcc7e20bde8c3cb7fff297cc8072090a1de9
SHA256

507e7a4fa00e7b3d1fc6e56b30f7bd6f16422f0d57b8f07eba29fb8d7f6e5a57
SHA512

cb262330d1be5400f607dcc96ea866d2dbfa5831a3b68e6837ea7ef83908587872f0337087882492cc6d41b50ddc759d1445ae4f1c21ed35d9ff9cb75b1c6bc4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4592	cmd.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact