d0cd7981277abd23bab4713e11bcd3326f1145e6430e6f3f3743fd46fb0d6fdc

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 10:52

Target

Stub.pyc
Size

799KB
MD5

082e64aa43f8e5f566b5214137cb182e
SHA1

71e94940cc6e4f6bb6f669ce3a0beb61a551db74
SHA256

dadc085c053fa61ea711a224b2a0addc89148d06563a863c10ef9b7c3e44502b
SHA512

fceef2620844e3bca008501d846340178b2711897e07b7032669694f47fa4a822163d964daa211822a1564dbbac79d05e4d55b4de3361d370e8b512447c99e0b
SSDEEP

12288:SCsbdR7HYMM1O0DWcxKCPmCcq99+bHm3i8Uv8s6sR8VOLsBWXszYr9Yw:dMBNMQ0dTmYTILyVOLsBW2o

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4596	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Modifies registry class
PID:2268

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact