b19d27dc9310cd3944e93bf3c35068cb89b225be33c38e28028d496cc2e28b7e

Analysis

max time kernel
498s
max time network
1591s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11/07/2024, 22:54

Target

REPACK BY CCURATOR/_internal/faker/providers/ssn/zh_CN/__init__.py
Size

63KB
MD5

26ce3ca558120fbbb00a0a1ca155f2c4
SHA1

f07b489d84e8d32e6a6dcaae5675c1714e7be30c
SHA256

ee4c7972d6522ee9363afe55f3cd6dc92b9de8370d1daa12bbbfbb56e831c4ca
SHA512

035752f0e221faa01f52ea4177005dd54f8c221954917fe9d96f3f24da3fd771aeb4760d3232de844664a527637735df9621e71684797cd0e6ab6f10062df02c
SSDEEP

192:kcy2bXotfgsywLctvHPfn/dCpKaQsogJEN9PShuAuBciWPshgEpb/86RDRyIwgw3:qZNywLcZv/lCMaGIEuh3Cvgib4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
828	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\REPACK BY CCURATOR\_internal\faker\providers\ssn\zh_CN\__init__.py"
1⤵
- Modifies registry class
PID:4892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact