c596f5fa261648273af72a1d93b866ef0c8fabc8ccf370025250f6448dbc4f20

Analysis

max time kernel
193s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 10:50

Target

lib/types.pyc
Size

3KB
MD5

c85f4be83dd4a287f04d5760cc1d713f
SHA1

35d62196e03b72335040057b57c0ce5700723eb9
SHA256

85f98714a0fb21febd45c4fd9c230c04c1491a52eda42cb14cc2190e5bc63309
SHA512

8dbd9ae3f67a07cedfec610bdfcce9b071f8a2cd598a38a51125cbc8ce04cec9b6fd2c0bc6ab28c671b500d05e5e71e3123b1e1ebbb95801bcec3d9b18fb71b2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2832	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\types.pyc
1⤵
- Modifies registry class
PID:896

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact