1dd9011c7f2faccae6b075e26c6c63977ef29ae1b761e6ba0a2479dc8a3de01e

Analysis

max time kernel
39s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2023 13:41

Target

main.pyc
Size

29KB
MD5

6a99bfecfca3d302c5e84fcffc17c2cb
SHA1

e5ba4fbec7b12250114283f59f3ec6f63fcb6541
SHA256

9c63041462f5807702cf3db884ae1e45f76a3ee9ed601439734f1864a0ac47d2
SHA512

3a51941b73893a1d69f5897cc4a61ed8f74b51a304ec5286daa713cd842c225849d85f97b5f504a101e1446af982de6e1fbe7e1433697b17b57596adb8274b5f
SSDEEP

768:pivl0d5jYDAlk+qA+GPiNq2V7OpIVFRvHr2phHPU+ImEKQlw7cC8kHC:kexjiqgSyVPVmVQlRii

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3808	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:2880

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact