97fc9ca5e07295a9d9d91b8808a6a30e302fb66f7cc103aaf87501d8f8fb54ad

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 03:05

Target

Rose-Grabber-main/resources/source/bin/antivm.py
Size

14KB
MD5

419246ff7441d4f0be8d8ea0394969ba
SHA1

30bb147e9065e58968f315bb3e55d3c7f24769f8
SHA256

d504658dedc9665fc13bb0e83a0ab35d69faabaf280f9a6abf939ba3dfe5697f
SHA512

0f82d63e617886e822440fcdc1007faa95e1be3b96f792a466a9b0115ac2b98ce30c1023bceb4e902acd6f8e2dc9fb50d9a4f91863a6dc288a43fbb6143d3991
SSDEEP

192:VzrmhXMuzuf/T2K0iKe8T1Hk6OIQd/v0BZtt/vDtoe1/3/IV/IG/D/6/DRKhAEmw:NKwAeQfOIQkZiqPKKEmw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4788	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rose-Grabber-main\resources\source\bin\antivm.py
1⤵
- Modifies registry class
PID:2840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact