0697f94db49fc7272e35c018ede19f07aaa680623753c93f964f0dd9e24c2536

Analysis

max time kernel
102s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2023, 17:41

Target

image-logger-main/utils/Browser.py
Size

13KB
MD5

bfbe95171b3e753da16049301861edbc
SHA1

623b2de689df5df8762f589e21a216ef6412c7ad
SHA256

75f0f460c0d766f4876b4e806473643d94323924808dee3d56c52265dc6bbcad
SHA512

568e88438b7111dad2f664de12c9beac4d04beb7e2800189909cb1f69d5f5841b3cfd09e4e70299beda8e6d0d4b081143f8411c498baae07b1b89b2620347403
SSDEEP

192:wlstEEaUGU3hPDUDUyHocanNqLmZEPLxAnAX1LfLiXRpJNyf745n6cI56BdIIKpD:zEPvudeFa3Acywq5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
676	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\image-logger-main\utils\Browser.py
1⤵
- Modifies registry class
PID:4260

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact