3134316cd5f860361755f9370505e440ee9fd91a2e15ae8c27bf5aceafb70030

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 00:16

Target

main.pyc
Size

723B
MD5

c568586fd87462685947012dca4d79db
SHA1

0a899e9cd82c732c565d6ba591a04c0bfdd5a592
SHA256

a8a0c8ebd9254af0e97a710c79eb70e26b063dfd4b31cc96b66e45dee95bfe35
SHA512

5d6ad73872e5e118daa54dfc7a85f1a8d9b7c70565030ba4a764ce00710dbc9f1f72c443a43437f97843857e73718b2b8dbe47cf80c1ec5a993899ad9a4eeab7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:1652

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact