222a95474744c4152632a32f39113b2e4463b687176165a156ea37b0128ae4ea

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 11:03

Target

Vortex/lib/__pycache__/aimbot.cpython-312.pyc
Size

14KB
MD5

acdeb4d87c5fab17721a6d7967839568
SHA1

3eb7376a386b4bcd8b9d0bb8a0184f709b112f06
SHA256

44780f74d986c8a947421971a363e93289b4dbb4f64ec7e1ac4b9779201c2410
SHA512

328f5f92fe1efbed51ad6a3b34801872c464a3b92dafb1d4b2283d0fb2e2b78ef2598808f1949772644d2cb5a445eabf260764ef4392b6e7b41febd6374e2ecb
SSDEEP

384:Aj8G7ByyD5Bh9yNrICtnMVy+rzzSQYrMQ:ALDTDrCD3rMQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Vortex\lib\__pycache__\aimbot.cpython-312.pyc
1⤵
- Modifies registry class
PID:4792

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact