fb1814fb9c9f6031ec7fa4edcbab17fe010b2e8677e0cb08cfd874d5774ac956

Analysis

max time kernel
150s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22-02-2024 19:07

Target

encodings/cp874.pyc
Size

3KB
MD5

f5df5fded37ea9b1ac40b9c2b0664e0e
SHA1

d3fcb961b0bf78bf3fbdde98fd13600ab92ee03d
SHA256

877b741e370b30d76be28fbab79df5e4abed36fd4f3e857f4baa1477ee93a8a1
SHA512

6330f9af0839d2e8b31f197a080bb1e1c5c4ab3dad38d192c7925fe1ecc52b357cc310cde411ec116df8a3f110f6bbb781f14165408e43bbdbaccb920e21da53

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3804	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\cp874.pyc
1⤵
- Modifies registry class
PID:3920

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact