2df3a1bea4ba0d40486ec28fa567386959e9e7cb5ac99743ff836826525d978d

Resubmissions

04/07/2024, 00:14

240704-aja8yatdpj 10

04/07/2024, 00:13

04/07/2024, 00:12

04/07/2024, 00:05

03/07/2024, 23:40

03/07/2024, 23:38

Analysis

max time kernel
300s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

168KB
MD5

426743ad2ba02e7a8646b4749528ae0f
SHA1

ac1a08da33334c839724e8680e5eade25d7cc717
SHA256

0f9ba44d8db56a7f478e6e70086024420794d417035a2fabadca101f602d441f
SHA512

aa87ef2e76ed8670e9e40ac01a4c385e31b652543af5fdbc1b7b8b5c934e94a2bf13562b3dddfd6e6223125a6650beb6a11441261d9c44e30dca1f8da6b8a6af
SSDEEP

3072:teTH1NaOO/5ESl1RdotPZTJ0pZXScT0o+IvdXzUsTWP:sNaOO/5ESFdoCpUY0oosS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4208	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4208	1592	OpenWith.exe	102
PID 1592 wrote to memory of 4208	1592	OpenWith.exe	102

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:4472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...