dd042c46ccab1eef92c289498b7825694a6aab6e04a093b2244b126af01c01fa

Analysis

max time kernel
173s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2023 19:37

Target

snake_eater.pyc
Size

7KB
MD5

c8bf7509904761a4317f33ed6118b3fa
SHA1

990bd77939ed4c65ad1a1f51beae195e82bdac52
SHA256

a89e7144b5a6100011da10f352e11778c1dc08374629378a9f6d40425c921014
SHA512

6f3e946e54417f7b926e451a328e4c7c8cfa1399576dd507dd1e736483c8d377608bd05320ed803b3bb4a50d3e7d573bb66f8dcaa0658ecbb8ef2cb37362f649
SSDEEP

192:dXY/v+kIQWHh/GtyfQK1Eg5baP5939BJX7JLcLL1lm:dXGgVdGtyfh1Eg5baP5h93rMHm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\snake_eater.pyc
1⤵
- Modifies registry class
PID:3416

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact