Resubmissions

13-08-2024 23:36

240813-3lyfgawdrr 5

13-08-2024 23:33

240813-3jvxka1fkh 10

Analysis

  • max time kernel
    90s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-08-2024 23:33

General

  • Target

    byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod03_ctypes.pyc

  • Size

    6KB

  • MD5

    f1296ab0e8ab54acfef7db2d0b1fda2c

  • SHA1

    c05baf56f3eca9e55f539b82788bdd0cee950017

  • SHA256

    b8925da6cda6e8a2622580cda0329f3cbd2db57fe1c7880d545201a049073771

  • SHA512

    2944afabb5ca13930ebf23a8d6fa208caa6e515dd103318fdf2db9cc896f1bc1720076a3dd8ef02b5312f59815c0c38794e144b229c2937a31492e4b999f49ee

  • SSDEEP

    192:mGMc7cBkYCsHYbyLYbufYbg00HiDaP7CmMdI:nB+kFsHAyLAufAg96aDChdI

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\byfron-01a570a3cd0a46f2\Celestial\localpycs\pyimod03_ctypes.pyc
    1⤵
    • Modifies registry class
    PID:2768
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.