e5beefef06176fb3e55d48b5acd73fa75221d0a4b5d6c8f182034f208a29c622

Analysis

max time kernel
144s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:00

Target

IA-1.0-pc/renpy/curry.pyo
Size

2KB
MD5

7d9c449b312214e3c7067c655764e295
SHA1

045d97aa69cb21ebc0906ac245cf09befa7ac000
SHA256

c6aa0debeaf3653d5bce9bcce6c2d96433be1780a6123b8993240cc71aefb5f5
SHA512

5d00084cffd007462bd063ec301384cb5cbd45b6b2ea1339e23bfd552060e8a443d4474835025af7179c29b90f5b18647572ace1109016d6a34385e5f89b18ca

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
180	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IA-1.0-pc\renpy\curry.pyo
1⤵
- Modifies registry class
PID:3812

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact