bded5cf8faf4c7ff8a7582538cd325da029adcae50b14f38ed4dc6adabc5673b

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
22/07/2024, 23:32

Sharing

Target
main.pyc
Size 4KB
Sample240722-3jjvasvbja
SHA256 71504675c785aed3d14ceb0ec19ac736e1d663a60a2be3a10fb7e3a483884acc
MD5 b248370c84e395334b5db2c23a31a406
SHA1 d724fd76f738e45295dd0ec67dd494364c6560fc
SHA512 03b4ca392cb07a7f615eed7a322ee913a1d74e4be33525d8158bd6a615019569fa48f40b6140f4990ec2bb385c90ceb5bc88dff9fd8bd53df9685eb82fb576fd
SSDEEP 96:zRAapvy2IqrvrtUHnPCf0KiqnPb4Rv6qvPrQZMWTwfLRPoOYua:N7HvrtU2Z6vxv8Zp0fVPozua
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:1672

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact