bbdf4c8d657e3123bd009ab086758bfd707f9b8c7f5fabb22783c4cb81784ca8

Analysis

max time kernel
443s
max time network
456s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
submitted
22-01-2025 15:18

Target

statvfs.py
Size

898B
MD5

4a3b595742f7c441d8fbbd1cded2fa1d
SHA1

9355dc67a61507bbf5e7a66dc05b6b1adb0f8506
SHA256

4ccf280dab73868ce5bbe1f7e146ef8acf2c189a77eb054ec5b7fbcee73dbd9d
SHA512

a6fc90ffbaa5665a9858aca59ace19cf66991817130085fa9116e5907e948b6897aaa0d46c7790046e71f17226e23d81d50032dd151930b2b3d557f188bc5a93

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1112	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\statvfs.py
1⤵
- Modifies registry class
PID:1756

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact