c112b2f07061632926d7d8f68614de49148fb529a668dc11909edde99bbc543d

Analysis

max time kernel
84s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2025 14:45

Target

minidom.py
Size

64KB
MD5

09b289085741253da1fcff221d0d38c1
SHA1

79a5910d9e7711ccb82681f1440c058ed6665a6d
SHA256

2091e8e2450e35f82b8bd2de80073b0154adb7b05f0db188ef2364588ad964eb
SHA512

b6745e3a3407d9f2aa824e0f03aff400acd7f251bcb8ce74cdf2f043c13cf29b68799d160435d4188dfd298ecc2af706417caa126c575c3096c2ce271a9530d1
SSDEEP

1536:jhkhrGetm1/pjbUf8ZQxkck7DIaVlai9a7riY3pNzVfFk7DcxWx8O:ef8hai9a7h3pVG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
720	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\minidom.py
1⤵
- Modifies registry class
PID:1072

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact