62c6091d6823e53697522c0cc46c4f6c0e651d908122679d3fcfaeac8e448b95

Analysis

max time kernel
132s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2024 17:07

Target

IDA Pro 8.3 (x86, x86_64) additional by QiuChenly/plugins/patching/__pycache__/actions.cpython-38.pyc
Size

5KB
MD5

7c3275ae6c413e9b2db9c8b42b46336a
SHA1

1ae931cd74c6612bb7a05e3235103089c8e141b3
SHA256

44ff11484f8305687a7a12a673e54db7878b232fcf9e7c2356fab316a86d7138
SHA512

704286ad185acca3838ebfae61c49fca1b1ea5e878038b7d6701b59c1970ec793952c4ef97518489f705190672a70d483634b4f981b407fdf4021a0657cd6854
SSDEEP

96:78mwpllQ3rLHWmdV7oPOoyZbh7lOLutYoa0elseOLOtD9tnWl/LHYzWljjL7Xzl3:LGg3rCiJo2xbWYbLPzT8I

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1000	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3 (x86, x86_64) additional by QiuChenly\plugins\patching\__pycache__\actions.cpython-38.pyc"
1⤵
- Modifies registry class
PID:4744

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact