91a1228c4cfdbeaaf15380c420543afd04e6d5c09176934ba935f7d74eab248e

Analysis

max time kernel
2s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22-08-2024 03:55

Target

teclamagica-main/offsets.py
Size

776B
MD5

b453d3e1e617e032e5926bbebe460d11
SHA1

472197cd30a92f64387f6dc681fb08b52fd67c64
SHA256

b0b9c5ef44f9e60cfd8a0182aac035e88576d1f6a8b5f556ecaca819b2e3ec68
SHA512

cbeb378684021cacab15c0c28a6078a206d9c1410fe0290009d4b2052e27b50b876cb77c60b559c36037469faf3d3c9951c7d1b2f92b6fc878964fcddef6bfce

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\teclamagica-main\offsets.py
1⤵
- Modifies registry class
PID:5072

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact