634df453e6b56918f9837719ad9fc656079f631bcb897da1055d889d8891828a

Analysis

max time kernel
99s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
28-08-2024 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Finder/test/__pycache__/proxy_updater.cpython-310.pyc
Size

636B
MD5

f5be89b7e17261a011293a5ee4001469
SHA1

d4aa64179677def53faf4162f8034466dece96ee
SHA256

02d600c92ce4c637f4b0b4c2844f3851c4183ec29f61abd0ce03275a617fc2ec
SHA512

81f736e2f2e11d336f17121c6f9ad603b7c6eae84e11b5cf6f85856445f5480a14104243e5760322e90c7f3f7a86cb671e9acf14e3c2b7e6fda95623619657d8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1344 OpenWith.exe

pid	process
1344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Finder\test\__pycache__\proxy_updater.cpython-310.pyc
1⤵
- Modifies registry class
PID:4388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads