1d677741ad3e892d6d66d18839957880e9d1344793a1ce1537bf5161a71cdc09

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 22:04

Target

ПроверОчка/Открыть appdata.bat
Size

82B
MD5

200aadbf80ceabc021f7ae98213cf3de
SHA1

5580580838d5fe9ea6240a2612e11ae7d070df9d
SHA256

04fac8cb5297eea5cb8fb5f645d53682f429d5e4d86db62d9ff4106e88aaeee5
SHA512

3e80c5f11a5592bed69f463e1335acf685f5c7647758195e53e376257b0246603704baa4532a20715b80d31a70bf31b939fea78f777b958fc6ec79da6dba989d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ПроверОчка\Открыть appdata.bat"
1⤵
- Modifies registry class
PID:1540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4828

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact