114880dba41978dd82378f3ca0ac0084c8c9f9e15d7a1d60743d513e5a891c7d

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

56KB
MD5

d417cf2665ea7525a7a0230638613503
SHA1

33d0c1641810a0c91268cf9f62554d51700ff433
SHA256

df1224e9226f84a21fe70cd68313d88e01bcbbbd00684a65c6c9ffe5c1184359
SHA512

ae2cb60c031b391c787cfab468f7bbe46ec206ef48b990ae4745458f1df185853bd781bb89c714aa97af0239ce06f627f8a4cb30f4e2cca9dc6039bda97a02f0
SSDEEP

768:hRVKq+o/bNhUr+kqo+E7YbI1xr/1P36gzQ/yx55A9xSXBLLAvoDu3++HaR:hRvzM+tfEVxrtLzQ/yx5maXAvoYJW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3600	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:4916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...