bbbe7ab600a7fa4046f140352477383375f740ac09ac4388100eba69f5284073

Resubmissions

17-08-2024 20:41

240817-zggqdawamg 7

17-08-2024 20:29

240817-y9zwzsvfmb 7

17-08-2024 20:28

240817-y9axvsvfjc 7

Analysis

max time kernel
141s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zenny.pyc
Size

46KB
MD5

55097f191a38b5e7ea6c43ad7228155e
SHA1

5902c8edb2fa0f0f66742d8879c2f8fab8d5edc4
SHA256

b0cbee39eeb98f0ce5fc4106427c4e2430442ec59b4209e8aed06a45ecd896a0
SHA512

b8186462ad13f974ceea1756108f653aa04126d5f7a355078e7a9076ca1bdc011b031f06bd311d2c6e35d07df67504f60cda9c256ec1b26b26716be815bbc97e
SSDEEP

768:hjYvYx92KaMsHgLmQmiSccU2+j3mrwJXENpox1LK0Q670:XxQmsAQOGGSM1LCK0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1016	OpenWith.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe
1016	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Zenny.pyc
1⤵
- Modifies registry class
PID:3892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads