0acf9a31d3fbee46692c4a92d867038b6296d72b7d1d24b986d3f558e4cb7c90

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub.pyc
Size

799KB
MD5

1883070249e753167dc78153e2326a4c
SHA1

73c3d759425f21638e9eeaea0972604fe180f77b
SHA256

57ed0a05eaca9932d88e48cad88eba55c103cad705f61fa9052b1d9573328d19
SHA512

f08cd69fd8cc37bdeb3e579c9c6df7dd45fdafa574a7fc74411ef11cbaad06f588dc06b5045da2bfc94244a765fc05cb482a7ab42f5248200ae9ae7690c80cdc
SSDEEP

24576:4DWVygd6NVH/xPY83LYVqnDmi43hOdXgKt:4JgmUqDFX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\.pyc	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
116	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3188	OpenWith.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 116	3188	OpenWith.exe	104
PID 3188 wrote to memory of 116	3188	OpenWith.exe	104

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Modifies registry class
PID:3320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Stub.pyc
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads