acaf7a1d32d6bd9e1f34ff6e707710810cc17b0f25c9ec7c329cfdc8ddfc1ed1

Analysis

max time kernel
453s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 17:34

Target

Grabbers-Deobfuscator-main/deobf.py
Size

6KB
MD5

6b4b50783ef2c9d21751cd38bd9b3bf0
SHA1

e400e78d11663a368d9852ccf4f1fcfda3296f17
SHA256

46614ff3690379626ab3109954d753d98fd750e4fd1d785172c1a82276ad5f85
SHA512

8d00d3a31534a30b588ca932b89b24d64ec8e6c5d853f6f3dfc3dc39634c507b24411cd870aaf96d2b403f12f72508af587b38560f5745f1f913ca3aefd264e3
SSDEEP

96:MbzxTlCdC+JU8H7s6pd9rng/mpVt/NSMA8RixUb8RisEP5fAoKqRqhp9:MhZ8bvBgmpHTrBsRqRip9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4768	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Grabbers-Deobfuscator-main\deobf.py
1⤵
- Modifies registry class
PID:4864

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact