2dcef1dcde5d2e6b5f9dbcd6e5631e2948d1d96ae7caaa437768abd5c9db45a3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 05:28

Target

main.pyc
Size

7KB
MD5

cb848851eb37a01e7e8496a69929e713
SHA1

c91d7beab5deb14b19eaf0fe86b9a85f9308cece
SHA256

f3a558a75c6efb66a2595969014fe8907feb0762276aa05cfa690ed5ce28da3f
SHA512

4d43fe8ecd5951c0cbf01e726092fd157ad1ed283274ba3e5777352888d5f471d9a926bf08d020cd44e77f547ded536a108a616b17ecbd05f47eb6200b4554a4
SSDEEP

192:wHxs/Ex7D8I2+WdXwxAdyB2qPJhwSmhbMdwAnCCAnw:Os83WuGsF2SmhbPAnnAw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4676	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:2864

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact