af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c

Analysis

max time kernel
427s
max time network
432s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2023 04:14

Target

ftpcrack.pyc
Size

31KB
MD5

7dec2a4693aff97a3c69a1bb6ec1fc5e
SHA1

bda38c25002ed785261343c7e1e085e2fa01e977
SHA256

fbd502647a65b3d2b1d654be47073f375cb67d49cedd516b80516dbd9c4bcc63
SHA512

d735d3ddfa942392d6982eb20621e0301bdd62dd1e804d4240c18945f886ad2ea50378cd15ae8fadb9d38b70743ad3f2e2c8e3daa82988595460e18c8a8e60dc
SSDEEP

768:m64+MyRk4o7v8Q0xqhtzZlryFu1KGxf6POOUExMTpKUcc9dDObS:m64+Rji8FxqnZlryFQhh6PbUEK9Ks91H

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ftpcrack.pyc
1⤵
- Modifies registry class
PID:1496

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact