6b1700a3961f46120afdf3c5e027556682badcae0015503d533c9f808f214ddc

Resubmissions

19-09-2024 12:52

240919-p4ffqazdpn 10

Analysis

max time kernel
214s
max time network
287s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-09-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

magic.pyc
Size

6KB
MD5

b2f3b8c51fc212840a568109668723fb
SHA1

43011f5d1c9d0d7171ee9bc02a544a0e908fa3cb
SHA256

944ef230c959dd122599f0c355c8fd319bbdb2dc95a0d9ea8e6012918a04af03
SHA512

4414ba510bded7a55898ca3f74b124c88053b7f100807deb64e7d7a476c085ce168f539fad240d297a7a1aa536c12b81175021368061c0007602131b9baef63d
SSDEEP

96:+G1i96z2ziW5SSUKBccccc3cc2yY1FyowsrnSzjWfagsfaeKjJZgbhWYdFlj+8:EbDVvccccc3cc2t1rEGavfancb/bj+8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1076	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\magic.pyc
1⤵
- Modifies registry class
PID:1040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads