58e8cf2a77663a1ff5cc36aa9e0777ce952eaa258c9b8220cadb5a53bed89724

Analysis

max time kernel
71s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2023 11:45

Target

_collections_abc.pyc
Size

31KB
MD5

bdd5e740d9f5f3098c61071b16a25098
SHA1

5275b0147b9fc299cfb7440f822d6d9b3fb2e2a6
SHA256

1999ef0fb54884aaa2c47eb952d1d0f5b63eff25afb5f43975fe08463d2e52cf
SHA512

84f4867b16c70a7f80b4fbac5633d9eb0ddaafec7139e16af8fb67c427e2db50fbcf426906440e9fa35b41853ce47f4db62818c4f9c83c273d86dff51b00ce43
SSDEEP

768:4pDSJBiWAf7ykm4y1BhimAqrEHzerKEEh/c3Ebj:8WkWBkmZ1BhimAUEHYKE0E3E

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4796 OpenWith.exe

pid	process
4796	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_collections_abc.pyc
1⤵
- Modifies registry class
PID:4480

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact