c51f1b4412a0eaab959527727d17a6bfd907720c60c37577d50e4fd5111c164b

Analysis

max time kernel
145s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 12:42

Target
poliigon-addon-blender/modules/sentry_sdk/integrations/starlette.py
Size 23KB
Sample240310-pxdcsada8t
SHA256 b20d510f333225f3bc87989fb3630eb7f0d2b52ebe885be94d2e1ca4e4db582c
MD5 e5e7fb5c2e4a002753d923a9fc65d6cf
SHA1 da5cc24577b4a3018081c29de6f1cfb0ee7523d5
SHA512 7ecd02c5a080e032e40e6a900d1e7b73685031f9427c0bd0c4d8e29c3393f9563759b2c6020b73d637bbcb6a3a2dc387e241e8d2f65a51fc57608bb69d1a126d
SSDEEP 384:UFjmZNIHC+5KUvLlfYfU0cVFLo/i8yYWSVS9OAwFb/fVFLsr1s4Y2jFL2IE9VoaO:TZiiF6Bw3crLkixYWSVSzwrLsA25LxEK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3120	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\poliigon-addon-blender\modules\sentry_sdk\integrations\starlette.py
1⤵
- Modifies registry class
PID:1316

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact