b9ca383ea8a408b569ffb1db3d2b7d2b210a228329967105ad7ba73b5488695b

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 10:38

Target

source_prepared.pyc
Size

171KB
MD5

cdfa33928817264f0902e94261227983
SHA1

0f446ffe251e10c27e5172b211e1d2a181f52746
SHA256

4c1f7c6bb2291e840c86b0fee49d562aa2c9f1c1813b551a7b9402064d015d7b
SHA512

41b0631eb9aa8771f875ab058a278f150cb5dd420db10eea4367fc02806d1387ab17385b7e42f03848a509f1ce777421c3a19b9ecfa0f8ede2949ba8c2675981
SSDEEP

3072:zUawFCpYRSFS2SVfXUc2oH7iD6GxrhQpvqdaPFHfsilDY:yQpaSpS52our6JqdaPdsKY

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2284	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:2636

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact