2cfd4c998e39bff03d22eac8ae46148915c05b2a4fb3c8fa4f986cd95edd8c26

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 17:42

Target

TwitchDropsMiner-master/cache.py
Size

4KB
MD5

323766183e1a876cb65eb43250818362
SHA1

89aba5802533357c5ca9a736b3d19b4e260c4f9b
SHA256

cce389a89cc933679a018f2d54adbcc76e6fa505b7167763f4ca9572803cde94
SHA512

0dd002278c27f3cf33065a6c8f21598e7d0076192ae2c1c80f30900ac799d42bd98d75d7915d1bbb7e98836853517598087fe4feb77010525cb8250cd21f03a5
SSDEEP

96:+rvA5NOikSv/O3x97TC92b5WYvTftRcgEoiCK/FWv:bdv/8gY7ZpiCK9Wv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4908	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TwitchDropsMiner-master\cache.py
1⤵
- Modifies registry class
PID:3460

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact