625c6bec52405dc8028322799222b5871253d4f71f5ee29e9155499a823fac1f

Analysis

max time kernel
1587s
max time network
1109s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 09:09

Target

HorizionXbetaFIX.pyc
Size

50KB
MD5

753be634e18fd28283d2f524dcd4bf3c
SHA1

492285399b0808ba9bb13059d1647341d6dcc4f9
SHA256

9ab30072813564afaa3f505f50c92f8acd25104f97d5ba053513050cfa3b6d45
SHA512

bac63a4ba2f74596e5c9106c0ddbf75f3e4d481923a8b94d726be4bb2b421e7a902ecff4971266168e6ca20db0a598786ac382b4175646682bb7235f95d893b2
SSDEEP

1536:t9MWFch4IX4GHom0HX68AkmDlhLx7USgeC:Ih7rom8XnADUaC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2320 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4816 OpenWith.exe

description	pid	process
Token: SeManageVolumePrivilege	2320	svchost.exe

pid	process
4816	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\HorizionXbetaFIX.pyc
1⤵
- Modifies registry class
PID:3304

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2320-16-0x000001BDB8490000-0x000001BDB84A0000-memory.dmp

Filesize
64KB

Download
memory/2320-0-0x000001BDB8390000-0x000001BDB83A0000-memory.dmp

Filesize
64KB

Download
memory/2320-32-0x000001BDC0800000-0x000001BDC0801000-memory.dmp

Filesize
4KB

Download
memory/2320-34-0x000001BDC0830000-0x000001BDC0831000-memory.dmp

Filesize
4KB

Download
memory/2320-35-0x000001BDC0830000-0x000001BDC0831000-memory.dmp

Filesize
4KB

Download
memory/2320-36-0x000001BDC0940000-0x000001BDC0941000-memory.dmp

Filesize
4KB

Download