6957aa3b521d1ddcc4a512e2fe7aa93eabf58e9a53a4acd4866c4930a881de28

Analysis

max time kernel
1373s
max time network
1159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 16:28

Target

exxexexex.pyc
Size

44KB
MD5

f3a787e7c2da671889a3219d587f3d05
SHA1

579e2b76e0aaf6d7327274d5e12a70f975a37746
SHA256

8eeb5933c9991210782c8d04ab5fb55a41544caf2234a3c96202a61c78bdc02a
SHA512

b005e4c4dd8d9be73b2efaac990a45c2a868046c131ac7bd801053a319b22bc634e5d1b7cc3a9f73ef0d18c65335a2a35db0a57839017ab54f14a0a315d947b1
SSDEEP

768:n9JWavmeVQ+gzp6LxOKH90Zf06pAFbo6LhrpJIkzRA1Sksd+Bgr48WPedDlhLx3V:n9JW4Xu4ObZf0mAhIkzRUSksd+SU8C8n

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\exxexexex.pyc
1⤵
- Modifies registry class
PID:3344

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact