3d8f447bac84309fcd2643c8851b79a4b9ecbe0f3ee3874ef172e85a2518c9b9

Analysis

max time kernel
141s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 21:12

Target

source_prepared.pyc
Size

172KB
MD5

92c64ca8610309825293b6704b761c4c
SHA1

96fac397179dfd2f1db8e84576341420a7316a86
SHA256

cdad2953e6c18a9610b44c408a6576564a205cabe5459e25c6bf2a87c49793b0
SHA512

e075557e4fcf2053a062e4dfa9ae0ea31811f170b4ad7e392c122717fca20044536168f3b814b4dde78816b398c6c3b1aed769836454c77562f60139ca8c23cf
SSDEEP

3072:CFfF8X0aOO9nY1OzLro6PZTw0I1ScQaQV+G0IvdXzsHsTWn:CwX0aOO9nY2roaIoREG0sM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3560	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:2912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact