Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
05/07/2024, 13:21 UTC
General
-
Target
jet/build/jet/localpycs/pyimod02_importers.pyc
-
Size
24KB
-
MD5
bc94f06a88cf8dc239f4f5f21b249581
-
SHA1
9c2c434475bc32fb03b1e251f835354823f6b806
-
SHA256
6a04e26ec9353e3c5ca5963ead62c282338e438172d943ae372103d1176a1a02
-
SHA512
db1ba53b24ed0913a3defd6acd81107b059286157466b6da2a717c1c7880d1f6d560dd8974575c000e623f50caf0a8e0e5b1977c4851add6ae8df52488dd975f
-
SSDEEP
384:X9QzI7LSq9nvn2aMiaQvbnhA9UBrkPlQ5O0eODtG0oRw:NQSLh9nOzGnhpklQ5WOUL2
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\jet\build\jet\localpycs\pyimod02_importers.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse -
DNS122.10.44.20.in-addr.arpaRemote address:8.8.8.8:53Request122.10.44.20.in-addr.arpaIN PTRResponse
-
52.111.243.31:443
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
DNS Request
122.10.44.20.in-addr.arpa