7c4ac543fcfc7455257da54be45158aeb17ce6757625ff359c1215d70763e469

Analysis

max time kernel
98s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 23:50

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/callback/__pycache__/aws_res.pyc
Size

4KB
MD5

48ef18ad7546bf44ad8ce6416834e719
SHA1

afe8f83ffff3a3142e6c72e328b6e06f43ab602a
SHA256

cbf633135e2624230852bc6ca1097da224062c5b27b6d61caf295d7951dffc25
SHA512

343666b48f48426bdb836bd589d098a98a3b433483f5566c5dd2eb3df51f013b5c4fab93b7d282645f71dff6f754a404dbc2a893d60e2395994e47f4839d44a0
SSDEEP

96:wWTnJjVHxZ8Mpwq+3JTt9Ff/kCqlkgs/P5e06D6NC:wu5RaMp+3ZhQlkW06D6A

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
920	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\__pycache__\aws_res.pyc
1⤵
- Modifies registry class
PID:5000

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact