c51f1b4412a0eaab959527727d17a6bfd907720c60c37577d50e4fd5111c164b

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 12:42

Target

poliigon-addon-blender/toolbox.py
Size

239KB
MD5

9d4ed315dbfb89f01def1934aaf224b0
SHA1

de2d5382b516167044fe8be5f96180e701187e5b
SHA256

df1ea482566aa51616812ab355c9c00e394563f0c6661f907f4e92b57c403c07
SHA512

08c582cd1c38791397848c8e5889509277d6415a977e75935d5437fe802e2a4348fd86acf371c1a5b85bc44067b559a2f3a9b76478146884e417707fa9144ec0
SSDEEP

3072:hnPokFecGGsCFv1ahaWTowuTooVC7RxMhrMpEk7ls:hnKaWkwuTooY7fls

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\poliigon-addon-blender\toolbox.py
1⤵
- Modifies registry class
PID:2940

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact