b1a82afe9c9e8dce45cb33801738b0998d3c60231f8c70f9051c6ab287e709fc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 06:37

Target

XylonV3.pyc
Size

13KB
MD5

1283295f829b8a2415becb0938294795
SHA1

f696b30376115c8eec39927e58b747ad97a4f2ef
SHA256

406b695b0b818ec1a89e4c7e97e66123f224f5e3acb6ec5e8f310fb6ac82ffbc
SHA512

b1499f400fac61a769c80b5b48340347f5da4e41e85ca142dd9f90c02867e2b8e0292120e4249d6bbabfdbbd7cdd28d7defea2675714533675b3050c41a42b0a
SSDEEP

192:1AxN/AghwfsVIifWucwIXziMcqHePvWmg0GMdxn/Keb7ugZyVNF7I+f0dNaA/B:OxN+rifWH5jiMzHM+70GMfn/Kgu1pfOZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1916	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\XylonV3.pyc
1⤵
- Modifies registry class
PID:4276

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact