7d1e94147b1cb92a59e80204e6297c87fc1bdc7618e173cfb3074561bdfe7213

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 10:31

Target

creal.pyc
Size

32KB
MD5

0a0ef875b8d00cf5851e317112ac9c6d
SHA1

2f18340880110a821f8a9d7048d69ebce531f5d8
SHA256

f2350af9c5f10dd15936d9e7185301911e2cf8859fe68aa57642ecb4b586f8c7
SHA512

f529fa38b5cb445d3eb1c1b7afc3f091071993b1a097078eebeed3248f27938b2d8ddecd190caccaf0f752552be709fefa87fbe8e148e7b3a4039d3345448744
SSDEEP

768:L8Dnri2VsfNEiyAuAfKFMrRtfqtvEwS7bnjerAroaHDsIAvN8YC06X:Ijrwe3aKFcfDwS7fOPviYD6X

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3532	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Modifies registry class
PID:4156

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact