7f1a38fd773b31582ca90829feaa7ebbccbad51ff3f95eeaf0f1fbef41e42e9e

Analysis

max time kernel
6s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04/04/2024, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

[rc12time]key-clicker-holder-v2.0.pyc
Size

67KB
MD5

06969be2bf20c1769efef83a79640f6c
SHA1

6dc6e234e43ce2a0a73dc44232fcfe1da7ab0456
SHA256

ab2b1cecd8c5bb937302b6b8f704ffb8be19e13988c067ee0d9aeaeaeb79f5e7
SHA512

121384905406b680be385dea1a42d8ca147d3dba9ed25e11658be849f24742ebbd89aac837e141fe7f8c4de75a835330b97e42f858238bc815c2c8bfa5583b23
SSDEEP

1536:FY5qpEprTLaVAH8wUYdGgrxn4jE+zMFvYtzBoYDW:6vnuhw14ZMFazBC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\[rc12time]key-clicker-holder-v2.0.pyc
1⤵
- Modifies registry class
PID:4072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads