85ad2e8ea6fa3e4a9e156514eb4ca74b2b846420c4d4d5d8e1f840fa722ac401

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 13:58

Target

Stub.pyc
Size

875KB
MD5

994e5f5af9453a94fb564fb2752086fe
SHA1

e1c026a9988640d6d93a584a2528dc286a159c8e
SHA256

11d5f78cd57c4c73bff8a3335859ea716e50eb3ede69171b6c06db2f6dcad974
SHA512

94b3f4eeb18d12d517e840f0132ff2b5328e93588a4e98f44d336403676a629e5ec99b303e4afb54bd6de1b0d8520fdda2b991655fe3a815fb63c1ab061a03dc
SSDEEP

24576:aXFhLhlhWWVOR87KmIgsk7CVzvSF+1pJtf:a7z7mJaA1pr

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
592	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Modifies registry class
PID:4652

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact