d28b5ac49d1df2d04f5c918c3584772efea9260ee514cf0062ea7936ffbc1195

Resubmissions

26-01-2025 13:59

250126-rakvfstjas 10

26-01-2025 13:58

250126-q91jhssrgz 10

Analysis

max time kernel
448s
max time network
449s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-01-2025 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rev.pyc
Size

18KB
MD5

76d9c01240ab981ba9c691aa321c188c
SHA1

bf44b3b9c394f21441e809d5e2306bd788a7985b
SHA256

a976ffbec62b18c6e1eedf6b1e5a7f19377fb92d0bf47b2c7f4aa58e102c8c84
SHA512

da44f9440b99ba2faf20c485adf18b65c3284d720dcc7ba75be743afc82219ed1ea699b1d9536ae63d20052e4342fcc264e17d426337a4ef8f644477f485c781
SSDEEP

384:pwISn8q/G/CcyPZl+/ih+kLLPeEGPwt1herNtPenvo282+65IFQDg5hPXcn5C/pl:pwIc8q/G/FyPZl+/ihVLPeEGIt1hext3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rev.pyc
1⤵
- Modifies registry class
PID:2572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads