de52a09d9ec109090b32af3ff15618e6fa80a2413019c82fe9200968c8d3dd3c

Analysis

max time kernel
35s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

b56af112abd2896c9f4e9002f0177a45
SHA1

b1b9776e1ab58bab5585004467495902079bfed5
SHA256

45eed04e3e91d024054ab356efe5e1024dae9adfd22b87d36b5b4379183e0a6a
SHA512

0f94f2205ad53bd9d90f5ec2df42ccdb6c6ca626ced86612c666915a624617e47a0dd40148d07c1f38fc27634bd9e1a09ff351c2f15fa829b879db5fc0300fbc
SSDEEP

192:wuwVLsD8gZeIWdXwklzTmS8JhwbgV+Mdwe2Dnw:CetWukjQ2bS+Pe2Dw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.pyc	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\pyc_auto_file	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3096	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	OpenWith.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 3096	3460	OpenWith.exe	97
PID 3460 wrote to memory of 3096	3460	OpenWith.exe	97

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:2428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...