9b73f8eb1505799749b1b15c7a9ed63448f6b7658a2ef912dc4ce2b57b38ad7d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 01:38

Target

photo_quality_update.py
Size

938B
MD5

c28014e8d58da631aefd9242fa19d8d5
SHA1

5d77c08e0f0865ab0af22f50e1eac1e32954dc66
SHA256

2f28a1971572899eb5de4859ebf4284c17b8cf1e2ee0c06382ea65e0f3df1234
SHA512

bdfb1add63ed349ff24576e626f714751621fbf47103c06b8029b30bf510a316646594208c8d03e31c80bf0287afb52b754be0a7ad4865a1cb2c8c8085e80d50

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
536	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\photo_quality_update.py
1⤵
- Modifies registry class
PID:4596

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact