79a5ab7ace5f96c99a911dbed7fec7e66f5ee0416533d83a3fd7da25d078eb4a

Analysis

max time kernel
434s
max time network
1155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 22:46

Target

loader-o.pyc
Size

371KB
MD5

85773aff7cfebcc17524c4bc12424e1d
SHA1

8e2ca46270b946b230132d6b72af57ef5087cfa4
SHA256

595f23e796d7d9fc03f3d8efa9a2bdf23318369f8dd559e846388188ad4a005c
SHA512

68faa4a28ad5e0b66594e9b2db9d8a999eb75eb620067e56229696b23f3774d0743d61c816b6f421ee55ceef95253c3c6c7d981852593fd9cc629a20a0161b66
SSDEEP

1536:6t9BSYAgyqK15gG/GNpeOuzciQG553EHqsSZacV3DwUVU0kmGNrZNCqc9QHqiNfH:6t91S40o5CoeH9ju4Wr0gOatIQd1

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc
1⤵
- Modifies registry class
PID:4428

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact