Overview
overview
6Static
static
6data/pytho...t__.py
windows11-21h2-x64
6data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...nal.py
windows11-21h2-x64
3data/pytho...ing.py
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...hms.py
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...ric.py
windows11-21h2-x64
3data/pytho...thm.py
windows11-21h2-x64
3data/pytho...ion.py
windows11-21h2-x64
3data/pytho...t__.py
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3data/pytho...12.pyc
windows11-21h2-x64
3Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-09-2024 12:58
Behavioral task
behavioral1
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/_conditional.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/binding.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/_conditional.py
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/binding.py
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/__pycache__/algorithms.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/decrepit/ciphers/algorithms.py
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/_asymmetric.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/_cipheralgorithm.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/_serialization.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/cmac.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/constant_time.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/hashes.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/hmac.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/keywrap.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/padding.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/__pycache__/poly1305.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/_asymmetric.py
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/_cipheralgorithm.py
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/_serialization.py
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__init__.py
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/__init__.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/dh.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/dsa.cpython-312.pyc
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/primitives/asymmetric/__pycache__/ec.cpython-312.pyc
Resource
win11-20240802-en
General
-
Target
data/python-3.12.5-embed-amd64/Lib/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/_conditional.cpython-312.pyc
-
Size
5KB
-
MD5
754a9a8cbe99bb7397bc8f8489ffdc50
-
SHA1
9e483be824daecb7f82aa4001f907251be41e2c2
-
SHA256
60cc0f91eddbfb431bb37d4c4124ba3fbc97c0dabe4f066a29161b4832ccffd6
-
SHA512
d9f1d96063d472cf61fb5d8278ceaa70a680d7e3b42f6d1e3d6b423070987e9c93854dcd73220dd81e10207ec16e040d6a2429a775bed54857cdc7f20ae61856
-
SSDEEP
96:HHHGYpejiEHQZPakYKu02S7xAcKuvWg//Kuy4KuoNKuIs5KuNBU2SKuzv2KurOV+:HHH1pe+EHQZCSJxkQlqRvMLtwBl1Gx6f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3884 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data\python-3.12.5-embed-amd64\Lib\site-packages\cryptography\hazmat\bindings\openssl\__pycache__\_conditional.cpython-312.pyc1⤵
- Modifies registry class
PID:232
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3884