Overview

overview

10

Static

static

10

.SIGN.RSA....sa.pub

windows7-x64

4

.SIGN.RSA....sa.pub

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py..._s3.py

windows7-x64

3

usr/lib/py..._s3.py

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py...es.pyc

windows7-x64

usr/lib/py...es.pyc

windows10-2004-x64

3

usr/lib/py...ons.py

windows7-x64

3

usr/lib/py...ons.py

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

usr/lib/py...aw.pyc

windows7-x64

3

usr/lib/py...aw.pyc

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py...10.pyc

windows7-x64

3

usr/lib/py...10.pyc

windows10-2004-x64

3

usr/lib/py...aws.py

windows7-x64

3

usr/lib/py...aws.py

windows10-2004-x64

usr/lib/py...als.py

windows7-x64

3

usr/lib/py...als.py

windows10-2004-x64

Analysis

  • max time kernel
    23s
  • max time network
    433s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2023 00:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    usr/lib/python3.10/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/ec2.cpython-310.pyc

  • Size

    836B

  • MD5

    cb8f106afcf72b45acc79d8fd371f5e9

  • SHA1

    2e80e63fa73e3ca6b01384e4e7ab8b3119ef5a5f

  • SHA256

    c0901d47b7f0a26022a99aeb483c55c55677ee74a87f51f30280c53bb6ef0892

  • SHA512

    fc6a4e2ca32ace1726b89c12a4422da709dc87d5cb9f790fc869b253e46857c3bbac07624dda6ce616df96b2b89402e5ded8d22185b3b5d8be186b2af651b9fc

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\ec2.cpython-310.pyc
    1⤵
    • Modifies registry class
    PID:4964
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads