a0aa71cb1b3da669b7a93d4e0a23805a8a787ce9851f72db9bccb7618fba3691

Analysis

max time kernel
315s
max time network
397s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
11-07-2024 00:09

Target

kizagan-2/kizagan.py
Size

3KB
MD5

5a850c234ebed3e5d442da7b43a4db42
SHA1

dd84e69c093ac51c76b54530d8750d42577ee96c
SHA256

a00f0757b7ca9ead848c937773d1ce081598063dd95afde960ee81d4588692a3
SHA512

00ddc81b8ba620c10c4eebc5965ea7d2577d4f419ad2c6afa217392c1de5faee097e976e0a71bf595070f4d25f21f43336666d08930f5b9c709860a6583e6a69

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3840	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\kizagan-2\kizagan.py
1⤵
- Modifies registry class
PID:2768

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact