793299d2d22a9849b67dec8735eb8fdb2ac6cdc763aadce73e84781c0c5a3f41

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 22:04

Target

source_prepared.pyc
Size

180KB
MD5

6004aca669d6149bbe1503536ddad326
SHA1

8ab195b6df3e768993f651983f07736f1547a896
SHA256

d6f39c938b46bc6eb09a4d0af24ddf3742307a33f900ff48ce97dde2e85b91e8
SHA512

fb104e7115a1e20370442591564e6afc47422dcf820c5152ea04a854cfb6fb3809223652dd6eecec67957e4bc062cd2a50dc006d875b4524c1abf32576d201ce
SSDEEP

3072:ZB2LaLPA9Flt3opPEtelZN+thZa6CmgQDzcCknW:ZIWL6t3op8cN+rZa6CmgQDICr

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:5076

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact