4026e330b06e54fb334314ecac5ceca07830967a84f11bd8803a20164653109b

Analysis

max time kernel
1767s
max time network
1779s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
07-03-2024 17:13

Target

creal.pyc
Size

32KB
MD5

eb61d23367de0ebe3776c297b3af611b
SHA1

68308d6df71bc573e56d3023fdfc7729e05f0dd4
SHA256

2fa9d7b0f42e63994c1f96c6cfae62f9c3491a53605a1d2212309cd8cdd132a3
SHA512

6fce08320a5f37ba6da9a082634a3b92040c58f8846fed09c000604474f94f09aebf88c2c1cadbea63fd8762d6aa83725a700707159b0e43748447bb46f6a5f3
SSDEEP

768:L8Dnrt2VsfNEiyAuAfKFMrRtfqtvEwS7bnjerAroaHDsIAvN8YC06X:IjrNe3aKFcfDwS7fOPviYD6X

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-682446400-748730298-2471801445-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-682446400-748730298-2471801445-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3844	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Modifies registry class
PID:4540

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact