7db638a00ccfb9a079adf367cccbb5eadcd57f21b20da229eaf67b0e494eff5d

max time kernel
416s
max time network
423s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2024, 23:11

Sharing

Target

Blank-Grabber-main/grabb/Components/__pycache__/sigthief.cpython-310.pyc
Size

6KB
MD5

11bbb90de40c37b8b031e4c6479b0c92
SHA1

55b2c2043db5719c0d483f2c7d6ead847cf710d5
SHA256

a55f8e02d66da616f8708ea1f1c7544b94158842cf83e3ee18075f6dd2ba1f16
SHA512

aed5944dd60ad4978bc86466d801e3d668d0b822fb5295c22aa91ddebb961e741dc31963c28e322582144c625eeb9931aaa12707de43a827d5fdb995d2be9133
SSDEEP

96:mXcH6ZnJ9DL12YMmlNvOTySgevwqmIWTx2VvrfflkcpwZFU0Ep:mkUflNvOTyPqdWTMdrXltuFc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2400	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Blank-Grabber-main\grabb\Components\__pycache__\sigthief.cpython-310.pyc
1⤵
- Modifies registry class
PID:3440

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact