1f15234ae7dfe9ae00489b29189706a1dceaeb1128222f9920488cbdd462faf2

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:02

Target

r1-obf.py
Size

4.5MB
MD5

7bef23a17cf81ae738d58c5487f004ea
SHA1

61fbe50d38b89c67d8a1bc6fdec5e2963d175c6c
SHA256

1f15234ae7dfe9ae00489b29189706a1dceaeb1128222f9920488cbdd462faf2
SHA512

ab13c36a706f4a1d85f868043fc1672f9c03e4c2ef50ec4b9c699b7794f4e581fee01c4b10863a26eabeb37a84c62f740aec7b510e5e6da81142c9ad2a1f4299
SSDEEP

192:C4LIitA5BBDpYhK1GlLW8B08WT5bGRZodCF/bYxd+:C0I/zBlP1GJCVTVGRXF/bw+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4016	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\r1-obf.py
1⤵
- Modifies registry class
PID:1368

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact