24de2b71477635f2bdb96e6990ed37de9cb8848dd29210ffe8ddd1d0ec948734

Analysis

max time kernel
177s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 16:54

Target

CVE-2014-6352.py
Size

22KB
MD5

03e4b8cb40edf5b73bc381f9391162dc
SHA1

b886c6550510c9b83bc6630f6c3493ec05e85fd1
SHA256

843c67233c84ade4b7188185379c3f68f5ef07090602a6fce41747fca7e10cdf
SHA512

2a4abb5c80992155c331c6a656c28672707020562bd330a234feb04ac5041660c81f5da34394e93d390f27bc05722e4d59d9df2fded4e23566fec00faaea74fe
SSDEEP

192:q4f7212OUSqaxzomyoSNPThTSND6knxi7ElS/m5GK7:q4z212nmorFhVE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4840 OpenWith.exe

pid	process
4840	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2014-6352.py
1⤵
- Modifies registry class
PID:5000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact