5188c69bd772ebe6ca8b34e8c08eec90f63ffcf1d6ab20287e074732da21076a

Analysis

max time kernel
85s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
09-07-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jet/build/jet/localpycs/pyimod03_ctypes.pyc
Size

6KB
MD5

97f55114b598cc197d056d5bd81a20b3
SHA1

62f59751230675b98105e29c908aef2e467636c4
SHA256

9eab6f4314c91a04a7e63766867ec79a09f8741938646b1823a03cbebc2df1c5
SHA512

b8e02bca2442314dc10405b2a8f3fd250847912c17b7d8412255311ea344c3d0f31b0791d026775aa3967bb9b854f8a0b33eacf348e5245c5c7fe486db9feb4a
SSDEEP

192:pGaERc785Q333TAG6t9bGzy3Gz4xKTGzDwvOxqDI5p7gI:lvtAPzbOy3O4xKTODMvI51v

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1945933150-1754111531-3454729080-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1945933150-1754111531-3454729080-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3260 OpenWith.exe

pid	process
3260	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\jet\build\jet\localpycs\pyimod03_ctypes.pyc
1⤵
- Modifies registry class
PID:2136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads