f11256d219127c83f602f1063c935c75a0289f2511a0ddd0bdf2f9a9a651c157

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
19-07-2024 13:23

Target

Stub.pyc
Size

799KB
MD5

705da82030cf97b716a775f4a4335381
SHA1

8cea03a5d4fcd6fbada33bbab15ef35d2e3a5a8d
SHA256

6153089a1d50a4e2970527068ab4ec986ba69c0b99d671b2fdf7caa7e9b0bb52
SHA512

28353cc9a587b4e6a197858f722cd9d68b666909b91f761c29291f3824299f96eea04f0271e4597463696030aee10f7f1b317bff3cb48327226bfbd3839d8a57
SSDEEP

24576:yq+9LVYGL67E0JzuJPKTXT7DFo4mEJIRo:kLZ0QJ+LX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Modifies registry class
PID:1224

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact