096e6e82a5841f892ae20f765ac340071ce75d24756a550773484d0a37fec7fa

Analysis

max time kernel
57s
max time network
64s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
05/05/2023, 06:36

Target

gptdsk.py
Size

17KB
MD5

9e7788921f684747dec28dc8891d9adf
SHA1

56a7696c8bfebb56088cff6f17bc281d6d160508
SHA256

096e6e82a5841f892ae20f765ac340071ce75d24756a550773484d0a37fec7fa
SHA512

a352d2ca93b66f4888b9f6fbc2e354b5443714d9badb6a1ab8a898854ad9e9fb146965c1f283b81b1879cc4bbec767da3b998f104db36b067eb00542e72644a8
SSDEEP

384:R+palzw8vGhF9txRRaUxIP1bY0V3p/snQI6oiZWa8i1EiFg//7:0MoznTDypaQPjWa8u7c7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gptdsk.py
1⤵
- Modifies registry class
PID:4256

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact