f1d5a873c18d634aa1c3d9646a021f357784dadcb1629f5d3bebf4ebac15a27f

Analysis

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31/12/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

64KB
MD5

1c71ffd73742306ca751d832353d8845
SHA1

00a43ddbe3eaa008ceb35922641bef5327246c46
SHA256

8287d8566890cc9e4829e8610aa54f31d93bd84a3ba127d3b382b379fdfcbbd8
SHA512

089679d1064687974ebfb1622f5bc4161a91b0bd86f81ae895d7de525d133bda56d1cf37d24fb491c6713f7e5e80ae97d2a5f7e854c4a9dc8f00c138fa1748d1
SSDEEP

768:Hoad+obVSwxUgmLkx7YbJCjeAppQ6BdjxCV9PSd5zk4Q5VdB5ozK6VX+Ei4i:HocpSomQxtjeCBdjx8O1kdB5oe6VXS4i

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:3368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...