ace0431aea0f488455755fdbb0b38b6580dcfc4c27df7cf15f9cac41a1c57dbc

Resubmissions

11-12-2024 09:14

241211-k7crsa1kal 10

11-12-2024 09:12

241211-k6m65awmes 10

Analysis

max time kernel
250s
max time network
211s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11-12-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub.pyc
Size

875KB
MD5

7e9d3f7f7059096cca31cc842cb6955a
SHA1

137a42a6781049d3385e4204bd6e8f2d9bb40a9a
SHA256

b3026f4c80eb87349337bc71d4e9aaf89676ca17cd7433c9cd79637976af1df4
SHA512

cb61086fabbf608b213c14be127d3a81330f729da42841699ed2e10def7d9e70c92afa2a1cc7cd3f43559e39d9f0d208650011eebe5a387ade7a22d8b9f7e71c
SSDEEP

12288:Nw9LB7gEqhT8tc/4v5JZEKXRx00gCNlcajld1nBefqbFBX30xqqQ9a0wv+tp/pUw:ELB7g7dQNE+Z00m47Xu7yWe3qwvjB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2764	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Modifies registry class
PID:3160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads