a62c67bb2c90d79ffc64d3862c73ea77255581d224a8736c470dc72a6716c6e3

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 22:48

Target

MyExploiter.pyc
Size

13KB
MD5

b2b370d9ed7af6e9ce5c70282a340065
SHA1

1b401e38bd858298488c617cbc4b1a3add683426
SHA256

c7469231ce73e65751a62beb5b3fc8c64db9e90391fd3af9d70f01fe27b0f7e4
SHA512

5c3a1665a1bd475032d2cfba2122df85401f2b8706ed92729c1465c231e587bd6be7dd20ab56bc75ada95dc2753904802b0fa5ae7ad236bcf01e5aa2cb20002d
SSDEEP

384:shomx5IVX9ZVsf4Po0xKk9cbgH1UYHPFrnwC9vXeBDGKpfdp:ZK5IVX9ZVsf4Po0xKk91HPFrnwC9vXUh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
944	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MyExploiter.pyc
1⤵
- Modifies registry class
PID:564

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact