b2996c6d10e025cd4f31d3a4626d286807576df292eee40068109949370245c0

Analysis

max time kernel
429s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 11:03

Target

builder.py
Size

34B
MD5

abaa9ea67cc53bc0205f56d0b66a22c3
SHA1

c28f2d35d0d12a3486489823cf74f0bf7f8b07b2
SHA256

99a23164675b43566e8c3ddaba774c973844e70d5cec1dbbfd6860b24f13a94e
SHA512

bb425d71279e0d3daee6e8a1e765ad2821d4c30609b66853277c4e8332525eb70f09ed3fb12301d0360b04141561a956ba666e29c1f892372a8224801e392a71

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4744	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\builder.py
1⤵
- Modifies registry class
PID:3888

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact