fb1814fb9c9f6031ec7fa4edcbab17fe010b2e8677e0cb08cfd874d5774ac956

Analysis

max time kernel
133s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22-02-2024 19:07

Target

encodings/cp862.pyc
Size

13KB
MD5

8f840144f57d7c17fee2d3c4e503944d
SHA1

33ddea7828904e101d99f9be7cfa4af55dd33471
SHA256

3036910e1367b669ab5bf66f1ffe66293ebb22a430759434b255c423e8ff2ff3
SHA512

bbad71d5a283bb244170d353d4c154e5c93e7d61095bcbbedf237afb764753e9c5dc05ae9b73eb48e82780bde264a2693df103a02ce283727b7fc54a2ec86a48
SSDEEP

192:1amkytQ+PfXOu7tSFCNz7PTV9+8PQM1nqokioJ+1GTnGRtFW/5VAXE2JHFtoSmxr:QwP2uQ09+oQVkfkTnGcPA008p

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\cp862.pyc
1⤵
- Modifies registry class
PID:1496

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact