59e4fac681f8e2e2db47821e1d1e1d76713363dadd006ee060d396b363c43e27

Analysis

max time kernel
86s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 14:08

Target

windows/loaders/bfltldr.py
Size

7KB
MD5

c03afd43bd40b6c7d815f04cae20fe1d
SHA1

5613b4e98965a02816e58f3e8f463f6aa1ee08c8
SHA256

7c53dedf35cb5377ca0bf66827cf771bd333eac7665c8ba356bfad2431fd108e
SHA512

d2079e4b290abe4785058d7dfb16710abe9c4b17b818aee479781dcf7120d0f3c8aedb68d1f528dda6cb0e2470819784de549e3c8a364715be7493192acd7e02
SSDEEP

96:NTmWPklDXfN0UNyqvmUZyOnIMnm2l35MbJrayWPcfmV+0GSJJ:LPklPKG1vZvLl3ybJ7zmV+0rJJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5064	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\windows\loaders\bfltldr.py
1⤵
- Modifies registry class
PID:4112

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact