8f98b9295b615636382d42add12e1fee1bb951c4d40f59c42d50f65e7f7ecf38

Resubmissions

09-11-2024 11:13

241109-nbgyeasmfy 10

09-11-2024 11:00

241109-m35ywatapk 10

Analysis

max time kernel
102s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

172KB
MD5

e8fdebe1109a6fd99c3590af2dd79e4a
SHA1

963f9c5c3e4979e692d85e7c51d80eb071d8db7e
SHA256

1f5ef7b5075b590d6d187f3093a26f0e15df8726cd69a86fb94354b1cdb99b6e
SHA512

3c968e735845bbd89724a0d184f0902fb94edcd22551b236c26c1c726291c7a4f779c336c933f02156992d2c6d801dbe8fc526486180a4141557132ad8a54c2e
SSDEEP

3072:nFfBHWC0aOO/WA1wD7roxPZTerUScdQQV+yXIvdXzbXsTxw:nWC0aOO/WAoroSj8Symse

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:2188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads