08694095beeaca20a7868cf9d157043ce171f69b0153eacf3a4effc9a6da24ad

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 09:52

Target

Pirkuma pasūtījums_(PO980043)_CNC Baltic.iso
Size

700KB
MD5

0c70f564396d55d8c3da4276c80f724f
SHA1

ae3cb5864c5bea73564cad83aa35fc593641ac6d
SHA256

08694095beeaca20a7868cf9d157043ce171f69b0153eacf3a4effc9a6da24ad
SHA512

983fed1ff80313b9d5bb7fb2f0dc026899a4aa9c414a3545bb9b6880f95524d0791a644de4696955e39dfcf07179acafc25d253a6034f19a429b818f878ffa27
SSDEEP

12288:VKry2/qZXzmowxht2fxyIL1COZLv4wkZzE96Ghz1X0aiyIWA1X1:Ury2uXzmH92fxjJCOvxsA96+a4A51

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cmd.exe

description pid process

Token: SeManageVolumePrivilege 4904 cmd.exe
Token: SeManageVolumePrivilege 4904 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeManageVolumePrivilege	4904	cmd.exe
Token: SeManageVolumePrivilege	4904	cmd.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact