0375e436fe77db4a2935c211c0e2898fca4ca972a82ffa418ae04a376e51548d

Analysis

max time kernel
140s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 01:01

Target
0375e436fe77db4a2935c211c0e2898fca4ca972a82ffa418ae04a376e51548d.py
Size 33KB
Sample240810-bdevlsscnc
SHA256 0375e436fe77db4a2935c211c0e2898fca4ca972a82ffa418ae04a376e51548d
MD5 170c9f14dd0af22432b7ae55ae1b1daf
SHA1 bb45f137fdb9511df4174e4af4e61ec019088bd6
SHA512 aafdc6653508e6fe0691acd204d0d1845803c53a04787ee680845fddc89497766ba95ab143f4f107e36cb69e8bc602e6d66397ab40de3435cdacd5398a2c63bf
SSDEEP 384:Yg1+MzaOiOi3Rc83IeCwVT1MlkDz/k74Fft1froMzZ8tJEbH8X:N1TaOiOi3Rc83IeCwRX7oIaHccX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\0375e436fe77db4a2935c211c0e2898fca4ca972a82ffa418ae04a376e51548d.py
1⤵
- Modifies registry class
PID:1476

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact