3cef3c12932c341f46c4e7a2dd39797ca12ffc78525d1202e9d432bede8ca496

Analysis

max time kernel
93s
max time network
209s
platform
windows11-21h2_x64
resource
win11-20240802-fr
resource tags

arch:x64arch:x86image:win11-20240802-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
03-10-2024 16:55

Target

Stub.pyc
Size

873KB
MD5

069ee2de8ab73a00ee0c12d6937c1fee
SHA1

fc1a6d3b28a213ab926037e41fc9fd64484a9495
SHA256

4dc6f0527b420515c5def293b1bc7ad116717b3c4d1a378989a1515309499707
SHA512

4dcc89c9c49b0844d3e03f2a4afc4f28043488a87b35ceec77a0077b31292447ba29622ff00b7f0d1720926e81ef9cb78369c04216c89572752182efa9d792e3
SSDEEP

12288:uGsJcCbPdWreLqYyNolSHP0M4KZI9GX/seTVr5oo+Ikpv6P0cjLJ64QrqNGD8p:uzJxlWrVNr0M4KZI9GUuko+I70v4qtU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Modifies registry class
PID:276

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact