cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f

Analysis

Target

encodings/cp1255.pyc
Size

2KB
MD5

fce0d534a2c804374741e7e898ac8c8c
SHA1

a99c77a7a23eefcf6c110913d6ecd95cf123d61e
SHA256

9565822bb313969c633b1a4aeab54329aa14fcca63ebfe35c9221e368196d0eb
SHA512

3fbfa22ef68fcd267b656ead060039b5239e672dcdf1ed9f92e08c46328b28dfcdef14426fe49e7346aef54d3244650c67982eac4dffc1cd77156a68ef67aba6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1264 OpenWith.exe

pid	process
1264	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\cp1255.pyc
1⤵
- Modifies registry class
PID:4048

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact