7e7297d1df16f5415075f14d03f6055796c0d724525f6f4976cc816e8ad5923c

Analysis

max time kernel
136s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 7.5/procs/__pycache__/ebc.cpython-38.pyc
Size

33KB
MD5

dea3b392537ad1699cf7324d37c050bd
SHA1

7f4b2484b9b8282025cfc4e0dfe2bfca37e0afaa
SHA256

f0f786e82f11c506d94a5dc2387353d550ca1245ef11d296f79baac4d55c2750
SHA512

0f1338598b5441c286614213e24cc1ff8e45df8b797540b6a1ecf2cb1a8531c726723420739c8d167cbea82e907c7e50fab753b995c17506c90a92285a5ea524
SSDEEP

768:LJXIvQ1emOVWEHUllq1ALIsBZDKTaNSKJlqJZgDsj:MQXbll60IsBZxNSKJlKZ9j

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

OpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4348 OpenWith.exe

pid	process
4348	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.5\procs\__pycache__\ebc.cpython-38.pyc"
1⤵
- Modifies registry class
PID:4864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads