4940155370f9966aa10eb0bb3b2948803b07b65e16e704664beb54eb29f49134

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2024 17:52

Target

source_prepared.pyc
Size

57KB
MD5

6a06874585a34858255726459751fb8a
SHA1

a327c28a245455619353a88213f5b3fef54a22a3
SHA256

982ccc5ae066ce321d62d02d5857c705b164357d8bab8bc3642b1323912ec723
SHA512

e5836421b5c0cf2a91daab0a6ec4d91cddbbba9ec801d3f39a040274941ca057a9161f9ccab40a3acee07b175778b3652dc90981bbf80031ea65c3164632d213
SSDEEP

768:wvFNqlgJ+zw6yRiNtJj5kQfxEoedZlk2xNT9mCCPA7dKL/oEUJqABC/PNz4XJ:w9mgQmiLdfxxCk2xNEspI/oPBEWXJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4348	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:4944

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact