9c71db0ebb4ff87069ad775118e96ac567f477f2f677766235203d055afaaeca

Analysis

max time kernel
125s
max time network
131s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
18/11/2023, 16:42

Target

main.pyc
Size

23KB
MD5

73fb0574964b00933d1ca45ca34e45c9
SHA1

f198607c2168c1d97cae2e1ba647b531e7bc0ef2
SHA256

4552d90f98cb8c85ec126361a9838b09b7a51f723561a4b868a8af9ce377323d
SHA512

67229a1b0f748282518b7f2bbe9019322db0a1c24d1e207ec31af301de2fbe58ea71249fa8ac47074fabdc3b45c71f19e7cc3b9d09ee3785b348d00a002d1e0d
SSDEEP

384:jimxi3VKYEPvpa8RGs7VruAAgwCR1el0SXM6jjD:jiWYyaAGgaGVcO6PD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:1308

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact