cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f

Analysis

Target

encodings/cp1257.pyc
Size

2KB
MD5

b601f8d41cfe2aaa0751cb0e74ec80f9
SHA1

b7650fa7e33a92f560fa64651fa925e21bf807df
SHA256

e788672ae4b9a6a5fc227a2ffc5364605662c413b5afb8f9f294ed90ac7db36c
SHA512

5f155a36c7e1bc10e9903d8be752935440b642d6fed8d0d23b13ffa4cd10b454df77b2c8640cae92ada4c97bb14a970464856d8cf12e39a190cb83f282e3e6e1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2372 OpenWith.exe

pid	process
2372	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\cp1257.pyc
1⤵
- Modifies registry class
PID:3200

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact