32abdd2910a308d9db26293a2be62184462ed68595d369b1002a72a614bfea72

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:57

Target

Components/sigthief.py
Size

10KB
MD5

d3559eae0b0d56c618f1cb4c84007f62
SHA1

482d6667850b42afeda3af132dbf3b3b76afe966
SHA256

a795b6f56664614188ff7e3f7168eed5c88c820423a17200358e79325265e082
SHA512

6ecfb74e74c5c0adb4f47448c3db3d0db6333a5635f2f1ac0cca0e1289080e5c9c01094eab1c5722a74d21b302296304d8c6cff00e1b7172a2d4d1b467d1a608
SSDEEP

192:0/j5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:06yMSfUU1l

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3404	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Components\sigthief.py
1⤵
- Modifies registry class
PID:4476

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact