35a2cc0635e0cde9cb882f2c24bb28c28b5b41e2c372a4c83b5143e05ecdc77a

Analysis

max time kernel
214s
max time network
317s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-11-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

1KB
MD5

1c65418e7a672e3c175033085cf5bc3f
SHA1

b21cb50dfcf93782bd7636dcb42b0206366b1935
SHA256

97d54fdfb92d4106f6301566e9121b9a3a277e88dffeffb0ad2f695e59106cae
SHA512

6fd7fcd7e0a70f1b399cf5942e535b16833907d1459ca604a2fca1da1c5a4b755302bcfed6cf0d813dcf27748023d67b84e18c35e15353ff9d28855e6c58a23c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

4444 OpenWith.exe

Suspicious use of SetWindowsHookEx 33 IoCs

Processes:

OpenWith.exe

pid	process
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe
4444	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:1920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads