ef06c37be8d29211b0f56b16e3a8e49f981a52ca09d8bebd885bce15ae405519

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/09/2024, 03:24

Target

creal.pyc
Size

76KB
MD5

fcd494f9797d27908e665993ba552d14
SHA1

3587096445e2a419f51e4a9bfeda736e95bf3589
SHA256

23814d7a8df0dc35fe69d0e7d07e13d44c79fed2f39ac92c4cee8323a56de038
SHA512

ad94651c0d7802fe6097ec5a2f2d22373a40db13122fe9d8403b868250dfaf0e774d35fc3fa360c795cda51f5ea4e1cda522c522888814b994d4450ee44b4b50
SSDEEP

1536:KLKOqK/SWSRjsJlflX2Is89RaJ+InaYJEuN6RKer:KhqFi2Is8qjxJJN6Rn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1568	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Modifies registry class
PID:4076

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact