bbdf4c8d657e3123bd009ab086758bfd707f9b8c7f5fabb22783c4cb81784ca8

Analysis

max time kernel
437s
max time network
451s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
submitted
22-01-2025 15:18

Target

tempfile.py
Size

19KB
MD5

147421b83f28bcbe5da60a8e1952a585
SHA1

98a78cb579e343d9f8f86edf8775ac78807a2ea4
SHA256

998a652c7f807b0dcc8e24949c88848c48e6819193138bf0135cc7d5fa8d9150
SHA512

35feb1c5c84029ce31cbb0cf54ccfdd115b038155912c74b97df69f1fc38f89305abf3966c5d5583b46316830e93fa1adf604ef64c31fd2e37cccabb495d5358
SSDEEP

384:eGech4xEGP/RkH6/dr8c4Mq7GKg3Z7oHK6i:NecPGHRe6/drl4Mq7tg3Z7oxi

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2624	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tempfile.py
1⤵
- Modifies registry class
PID:4892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact