d94259329e042360d48ba2d18cc630277afdaaeebf389dced4d5070831e6fe33

Analysis

max time kernel
95s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 23:00

Target

_collections_abc.pyc
Size

50KB
MD5

60b1b6f71502b5af1e52305a2a0b1db3
SHA1

7e3d6f0c2dbfa11bc5d46162c1b995c48ef0bf97
SHA256

575c455c2d7630afb48bc76c7320544c57739c7660b4320d0aaec909234c0572
SHA512

62e478a77c535c4bb1e1297d6f7cc5248c4122ec66192b34b28d6cf5019df96ee24503972af4b0f71a20806c12cbb40722436178a7b4b29f4af92a8dd75f5dcc
SSDEEP

768:4W0g3LUXl5SPb9TycwdvkimlmAQ4sqL7+w/jEthRUeRKivBjjW:4W0g3LEGe1vkimlmAQRqLShRUGO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_collections_abc.pyc
1⤵
- Modifies registry class
PID:4876

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact