8c2fb988b94fb4e30b0ecdcafd007e99b5a823957861663fb4f806c8ee8f884c

Analysis

max time kernel
445s
max time network
452s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/04/2024, 12:29

Target
KinitoPET-Python-Virtual-Assistant-main/Kinito.py
Size 39KB
Sample240402-ppdnkshg9s
SHA256 4a10afda7531078148fd68455724bb9f95557f467aa5740be66fc4aa0bee8eef
MD5 11be371fb29d9af17947128c5c571308
SHA1 21cf9308b0c640571e26d134a486fb1385b2905b
SHA512 9f5c722ce5d58d2c54bf74399ab36185ca9e4be5fabf707f7b7ae3b2bd38f210bf396ce72f5a6831ee2bf049771486a1c01685547a7d38f6aba6b52c2e1c3833
SSDEEP 384:/yYZ8DRdwHc+uqeJoVakvhk2n02/QnLS3+qUju6SzQseb6ADsOOZgc480KkF76wY:qnDcuq57jrz1rfVpieYkn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2396	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\Kinito.py
1⤵
- Modifies registry class
PID:3436

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact