43717d6c756379b64d7f8289e2bcd7a585ced7fcde720db6171a190de648dbd2

Analysis

max time kernel
316s
max time network
1596s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2024 19:52

Target

zeogen.pyc
Size

9KB
MD5

a3f5a9be5ff5b726b5ed338a36fa754b
SHA1

35e1a0f0838e2db24cb9ef4cb78cab9243b00b11
SHA256

e87646cac23981b376c6dfed83e51c54a1368b7bbdb70f927b9c513aec51e5e9
SHA512

5f24d2c6743b8d4418258b35fc5787da5213444c91a4b8b899ac52f05c3dacd5994fcc1887c5445ac32a605bbde29b44e649c44b75c49948f88158647000da32
SSDEEP

192:DpBMAlg11C/AVUerkIaMpevGhH6f8Fx4xkImnfOeWXiZ/QO:DwAlg11C/AWerkIa6GGhHA8FxUnmnlyE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3220	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zeogen.pyc
1⤵
- Modifies registry class
PID:4092

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact