Overview
overview
4Static
static
1Bypass.zip
windows11-21h2-x64
1Bypass/bypass.py
windows11-21h2-x64
3Bypass/config.json
windows11-21h2-x64
3Bypass/dat...11.pyc
windows11-21h2-x64
3Bypass/dat...11.pyc
windows11-21h2-x64
3Bypass/dat...req.py
windows11-21h2-x64
3Bypass/dat...ter.py
windows11-21h2-x64
3Bypass/install.bat
windows11-21h2-x64
1python-3.1...64.exe
windows11-21h2-x64
4Analysis
-
max time kernel
457s -
max time network
1177s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-06-2024 09:59
Static task
static1
Behavioral task
behavioral1
Sample
Bypass.zip
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
Bypass/bypass.py
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
Bypass/config.json
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
Bypass/data/addons/__pycache__/req.cpython-311.pyc
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Bypass/data/addons/__pycache__/updater.cpython-311.pyc
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Bypass/data/addons/req.py
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
Bypass/data/addons/updater.py
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
Bypass/install.bat
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
python-3.12.4-amd64.exe
Resource
win11-20240426-en
General
-
Target
Bypass/data/addons/req.py
-
Size
483B
-
MD5
ba4346a7f69b223ec0b49ffa0787de24
-
SHA1
46ce8dd8faae5833c209095a7ae358e8f33de376
-
SHA256
9561772fc9d7526560f1d9d8464028b5decb42b7f77633d2389f6ba03fede9e8
-
SHA512
2a34fe2110242ee70b8d518001ea1cd0cc44bbf16f0b15f4ff90cd680bf9f6c2a3d50efdf81da150468253ec61408adfcad9e20c3cfb3122e7a78db8b23bc39e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3564 OpenWith.exe