9e244b9f344dfcf1c59ddf59049740f8218d3b5e9c5b0b44306333da3097e8dd

Analysis

max time kernel
1726s
max time network
1134s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 04:10

Target

765678976567.pyc
Size

6KB
MD5

f0b9bf482d405c8a2d5e73e2f9414657
SHA1

71683a3023a3c0479a5c0f10445e6474c8628fa0
SHA256

03d9cdb70fe59a0137c6f9f5aae5845d10388e9e0eda43e451c4a08d17ef24cb
SHA512

ae524651d4187621f9f81255fee4345b5ed840c7fafe2f6abb09e5f1d064e8e8800a82cf8ef52ff84ab3268401187f5b0c42255fa222d735b87edf3001de6bbb
SSDEEP

192:JVGNWuqi88foW9YTqEFmFIsVvLqoRE2iO/qv6RxcqFdqq5XiqY4iVqi:7GNWuqi88fnYTqpFt9LqoRvi+qv6Rxcx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 9 IoCs

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\765678976567.pyc
1⤵
- Modifies registry class
PID:1508

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact