3ddb7f3c904a5c9de05ecf7dc0ca23cd1017447a334d0b664cbcbdd58eebf5e2

Analysis

max time kernel
100s
max time network
142s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
05/12/2024, 21:22

Target

source_prepared.pyc
Size

167KB
MD5

a4efdb3aa4d67914c44ac35214e85beb
SHA1

6bcd6cdc6f1d857c2139db5a7d3515492dce4604
SHA256

995bfe9e05a8e1ead54070fd44c254f1fae54ce96296c67d5bc93d9172a7a0fc
SHA512

f59c9d645f4998637b6bb89d564404231d130ba685c95a09c7af384f632c395269dae4a94c5060e43c32a826c42b7ded6751b5ee803300ba4b90cc5dd44c4bd4
SSDEEP

3072:d0UawFHJwdTQS2SVf+9bOpo87iD6Gx3hQpNDfh7xsilkZ:jj+ToS7po136zZNsNZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1644	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:876

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact