97ec311e0ffde2f3c26e4ff95ad37ad937db97fdf0a38e2c008d2f772a41e9f2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 14:00

Target

Snake-Main/vep-version/File/Stub/other/coded/Snake.py
Size

7KB
MD5

77b6e524a8e2f139689e3cc0560ee1c2
SHA1

bc1034f88e9452e202fa02719d540f6592840049
SHA256

0a7a0e525fec16389e94f8e70e3c07b3a0e7628e6e2928112e255c203e0d15ee
SHA512

9901543520638d3afb6b20d1a8f5a19dddba8b2b59916d29420189a37baa30e65eaa973b383669447487cd6d0f5882c7fc217359a5b00db260e9381c48bd8163
SSDEEP

24:I777777777777777777xM777777777777777777xM777777777777xM77777777h:H

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Snake-Main\vep-version\File\Stub\other\coded\Snake.py
1⤵
- Modifies registry class
PID:1120

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact