6db5eb8c9617d8e793a20f80fb05aa4eb9593f530ee7df69d45bbf2c9b4bf07c

General

Target
keylogger.py
Size 627B
Sample261104-w98ssaed79
SHA256 6db5eb8c9617d8e793a20f80fb05aa4eb9593f530ee7df69d45bbf2c9b4bf07c
MD5 730056c5e3f4916f806252d3f2b0a18f
SHA1 093bdfffcdf88a155f18c52babb17b1ab11f917d
SHA512 17013f9111a54f939770934633fd28ff8a9bc5e1d3ee72cc4c4fc139256639e11ba903685aa3330ff1607f6916475a820506480786e3178485112e0e7f247c08
TLSH
T134F0E70BCC06415056B0285DC714C8F0E411861AC5399282BA9CD73E2B5587C49D5D9D
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3020	cmd.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018C01981A10E06 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000263bf26d51023645bc9d5eb8fa7fca1c00000000020000000000106600000001000020000000cda3b02d43a116da28ecfe95c0dd7f389561089ca5cf7a45aebba3d5291f2bc8000000000e8000000002000020000000cc0cd9798e5db6dec9e35c225d6569afc9bb14b96418ac7327bbd3d98d8006b080000000b0f4debe8ca9ec8d86734cdfde4674788aa07c4ef60ff78277d53fd4abcca7d1ea4e8156e37a7e1feb28cf8728ea6b2aec5a4d10bc80621dfa20f8199970acea53d51260f831cbbf759c1be9750cd555064b460483e45f0b0b7a503a8337f12034e420e56089bca7b5f2a4568b5d15847b21c06355c828c48ca60839d4a5d21940000000b661d58940bdf0f4d0c12cf7c736d22e8e3e826a484699d04fc7788021d8e7f63c8260e77038efe6ab2bebe936d2332cbfec8ee63ccea904c9f0d94e20a172f5	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\DeviceId = "0018C01981A10E06"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{F0C62012-2CEF-4831-B1F7-930682874C86}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000263bf26d51023645bc9d5eb8fa7fca1c0000000002000000000010660000000100002000000009d23c47f5b72ee9ad9e35cc826f3684298e830824929d09b380ad97c94cebbd000000000e8000000002000020000000c4b6255367ff689c613315a2199814686894c52571366e0eddbfe9e033663851700f000038d797d16c271f643ae2ca144891ba3034668a8b542c5938f754897f078cebfd768ad4666340a84c8f8c1071604600d57f4ea84342abd07f6065696eb2f3ab2cd375bbb0fa24b90bad69699e59e8c1ea73d9bac3fd343e5dbf81bbe0dc791e65203806ea249f72073a2fba2d4d5cf3e3899e7fbeb0f6d4fce7211fd34f4813e2d5965fdd314e5722163e5087ccd4a06f1be339a2f0108cb7d452614f727b790f1ca33ea441b34417883093c2fb348e12bb73e856d3aa9d222fc7267c027ebf0cc50e10a788bad9d6b05b816868b88c6ea7cbbf7cf0b0eaae06e48ae1e1cd26b3734807862dfbb79e0f24cd0fd2af56b6b846e02ab052f7e54a5c4ce56a8392478fd3f77b0c4efaa0cd74e94b46690400c90055a234094c95efcee31e52e2bab4b7e56bb7527f374f191c1ac5c5dddedf0955eb5d87fb8b826f35ad385b93ad1746cce331115a676209cc60fcf48b87cd4e76351a871fdd696d78260301791ed40e11f3d034798ebccaf10208d3f54d62d02bb87407f4ecded74259b31e2c8a7ed25f060eadd82d8a0450f8f75a55ca3e2c4b0f0466ba26e68183deaa66332faee7949a8d34fa374883f9001c6ae4d74c953b63f1045b48910345cfb0bd244162b0a764530478e4b5ec66ebc6aa85cda29995f8ab7e3360fdfb6cf96c38b28fd04794a3de590d574d0c62b4b98d640b78a8957912b14ff909728448327e34cadf63c44c13f8c1a5e250487520abf18e5a01f07d8b4475dd8492e96ad16d41c8efa7ec273d38421eff3d69fa5e2a028e6bb94842f39e6ff2cdd9e9bc56a70beac243379c0440f269011b81d136d319f9d6d685ae61ace5169d59a5009920f2d5a59ec0c25b926f13b2f1ae17db7b1be2babbc768a6db72d903692b12d8d710a49ecfea052e01e26b8d07734b813f2d377b60a8e02388ef55d003bb3ce935d6f9404dc0985b4b9c3a9f78ce32e324a44df4543c028a1012c6c61e309da03f66b271894b15380ab497b3a86a3cde01504642de5359ee72d0c461347843b922fa4a8bb16a9bc1cbd38b26f8f34c353ba8d206ab1cce6c52e44caf0707ae9580e0550b476e7f16cef16c879a04f3a85e186f0888ed99a1d5ae6d3c27ff4f5cbe3bd2bfcc5e7c7705eb7c4b72fa6bacc188193045b4f3588ff85ba32541d445d920e02b050e10d0c3aa3251c24eb33540990a83f5e6b64bc8237d9a155130725bd477fc186b900858d10c7f08e9a202d14a247da9c6a8e0dec9f2d9de64d5a837c2a237e101a6a8fad20738ca2394b157a44e2fc4c2021ccd4549c2db8bb04c65996f4e433cae3fcaac82c84c7a0ae9902c1a3cdf350efa8aacc78098cd7d49196fba7ae7709d40c6882eff31e1792fc63189de291c35cfde67c5d890064e0ab55a4a579b16ecd1ee3a0de20debcd6db8d39ab504d49d979ed2bb51104efacf74e649824a98dda221a7ea341ee25612084ac9fce4fde88fb39df2027f49426e50703baa11f13cf49b81809ec27d10bd0f6fcbf5a68d956f76dad637b53803447b32773d977762776fba8bf1aac4ed13c6b4d39daf803181b0d6dbb66cc773ea5725fa5c8f7f6d7c3f5e96da8bdeb83a80c45fc42147b9b29b9d34836ad6d6d449d39461a964a97847c2ea22016298a9f2a116c7024d8897344207f730b113d1e2b2bc30288f26aedcb30eb9de11117477afeb0db161a52fd7c08663e66bbe9aefccfa71016924de7858ce98c4759a9289bbfc8ea6514ff411e0181e17a1041dac77157eb0de71a2abed97a35719471080856da4480496cad70c346f9ea64300cc6545491aa8d48d5c74ce35dbed03ed616b06d05ff2eee50b3bca0e0bb37088e7e84a537302f418ca022ddb8bf41927f0cf2a09bc09abb29d8e19a7e4ca37f0cd29c775668fa0dcfcdb7406b59cec781f6fdf2d0a2d73ce3a92af27766c51ed7ae2f7733778ba0cda76f16e21a7c429d5ba546b7fcdd76a467fec03f9fa701b02b07e709915c2223ffcf017ce06d7f6c2481f0ec66c98c14b5fc8f88d670d0a1b021aec53d228465114375a5c0adec2f9fc8d5b6eae391f3d4acb1398ddbc301b944ec951192ce04dd9d1b26ee59ac6f21e192d17ec075de6c6f16dd39daf04217fd77b847c256a8dcc356c72b237b908161b4e3244133d0200c25f8d25832f58b8f54bf2d5f34dde425e146586b907a1a6df08e0f5b2c881f891aa90c880395be4006e967bc4579829ede82caecb809fc630c502005b2af453b74fed16d86393694089e7f610bd97b689a203c46e259097c7bbe3a232b6df55032261ce3d640b51bd902ec212649f2bdcf1716bbc2c70ddea3ee88a9949dc4ef1520493e1bcfe3a1601e31a8389f35e20dc6b9474d91a4af765393bab46f16c81cbe5dcd8d89d73399d1de0bc989168937434ade79f16d83d1f151e75e6796cb638cab0784481636fa372168711fbd8cfff433c8b68092f83164400deef79df65082547dc716d93d6fdc9f4befc236a3d936c021fa67b89f5498f571a80beea2f5d0c9e62102486bc0bfb1d8028eacdc059c5885fa9e338f760526953e9d5d98cfe1e13fa8ee9c774f2e3d45bb07dedb56205e7425f47ca7d4c3e7c2cc9e2dbc4ddb257f5a9dcbc464ae93987b2858d3c75252b49d1979147dda39b00def560612b1356ad6377fd5553d0d6406e69438359c9cf6c958170e2a1cbfbaad0efa89fbd0b53b8ec8caecf310cc59d255f258379e23805e680e2e581195b5c34a5d787de3a843a202325275498cb46a3029bbb0e02bb66f4ce08d88d24463fd8893a293fe7e36a1eb095e3e9a2d1f866ad7896c03e49302023a67ec36cf21d985a437bb969bd3e3a54c79e81ff49da19955fd5faed80bf75f200bc3bd45113a75ab5078020a25802963596d34d2333b3a917e68988fc13d46536cebd42b4914c232b07503af21dc3054267124161e2e38dc75c41adc3ffa2406df13e5494a36690348d637884b0c7ea277794beff245dbd6a755783256f0a8909842a37a1e9aafafc52e9f1ead22952f575bdfdc5aa59303b7ccb10c547914638166aa12e84eb119e929bbeeeebe3be919b1157c332eecb7a61f1abd2a3b3ed05b46378dba5a44e5c1e960d838dfc8eb0352b04d16d6e9d4de8662eb7094dfbd4e864766079633bf34033c09d2f34d35b0348fafcbbdf9c37d6b9b519593cf61eb94f53e2c6f7cbbf61150793ed813c6643b6decf2dfba40799420b3b03a4bfcd95979ae8108ebbf253c455917d85d5105416494a1e629551c991db9568832178a2ef54ea05d0bd9052be297828854c3ccba5fd6f3fc474a5756b0d929272d02eb978d69245af4e5def73658ae88055eff7ca77d6c169db389049648955e62282a9bca8bb332b1784df7891e6bd52b3433e3183b588b6d69c000775f7f23c70dde2907f44c298fa7f0c9583830679d02e910cf2b734cff018ff47588a5668b8d7d10f255fad4744a44178e9ee8476c18a8ff010d03c692776eb905afb0540c6c74b7e4d6575763de3f8af75e1cda3e4030629b4e6f93e6361f1b662a29625ee5ce79dbf956961f7f7c6917d328c50c9924db61ff46219e73391ff0d50e7ea0e8f35a47726452c345237dcd79d58b760d9629ec0f2e037889131919379023daae5c4b9da4fbe3412c08817650c27e389cdaa92a2bdc524aca30e19afeed9af52802532a533208311e99c0cccff8dedb201dfbec0517d072eccf44ab6f1d75738e59debfccff5643cf36c6f9a03435e977ce0966662381d931159ca560c284b2449d932f6ad913614f32f04da0e5197d2e946ce97b79286924f4a4d934f166f51b1aabc757ffa5f0ada2249af3a5afc384f92442e55b85d88ec5451b6176b93cbe694a0846e50678245d61db61efbee867fd44abd74190e1937a61aa49ed417f360472534b36f22189a3e617c21f108632d20932826b7c35c94b8714f0015ab5865517b87ef88e8f944b980e1742b13bc686c9ec350153d92dc79fd80b438bab8c185f214550bc9fd56df9d2309f9f5d6b78a6c75fcd891951358a2952bfdac5f74c2f616f02db57e09c9b3af8e566f4f3dae9033a1a9b35b019edc6fc555cfc05c013b062b3cf9d43035d2ed9510b2b1712092d1c6ec703baa97853b230693f1876b37be1af59be7ce4571c348a5227322abbcf2e26fb0ccf2264667d3c297652b2eb732d5a22ce53fa273ec8ab1359fcdb3f3cbdf20922a0b509d70c165d638a62aaa346d6fa711843c6ac7d10d6e870d22a5e062b0c164d7f4b00c1aba6fadb05c8e278f8e49ad632ce0c45a3f10a9478348e61e7d76777a2c571b984d828e797b5367bf3e0a3b6f4c5e1df28b96108889781ade74ccf5b712bdce632dc64949a6bd1411d54892cf36054e7c7adebb5885f05d8afad8ea3ae7409070f4541157d8376761dcfb232d61f6f599364eaba89608e0832c24425e31873919c8be2f7265d6556889274339866758036ec46efdf324717cb546fc246e0154652544ff79b6c931228a8a5c821f8bea21b02150cc7d8dfc0c7c4f8ce4090cdde768e68a59e6734cd6d0d6cd745b793b587f6df61baa9b039c0a3425299aeddc6f587fb5983058b359c3fa34ecd02cd20796589af0e12b8d7619135d6b7a6973393f44da012597a5012810aa2556dbbd7fc7d998c24787f138a582b7b5064ba361fb47a2dd6dbab4efee3d8b9ceda4ae20a1aac1b2ada633d3043f314928016c4929b7a9e78588082e8d872a94fddd6a94ac546b562a8925390cfc2286242e5161013999f0ba9f786392fe93496e41fbe4d8d2a8c7561ce9fa35a1590027c37a004debf018255d034ec769b905e15d81d87d67dd47e121b0d29ef12f0feb78227bcd28407fe779ede54c95ea714ac92c8fd172dd4fc9ae071e12079edf8e62d3c2d00fa41c4c52c6edbd5a5462f1aec2cf91a0351a108a96805448893fc0dd3a609afefdd8bfdc49854207355d31c565af2683b16c05f1a354b8c85c5490945d66e0ffc3e847b5070c9ea6a7a3f93633bcbfd09501b6bf890711c6ca5d981ba26f884cd5567011e701848e930683122691d83b162e87fdb0d78a8df9771afcdd09fd44abb3bd94b4d27ac2022c3494d2114fbd745d512851e3306e67814c9cbaeff66157ed9dd1b14db62810e7c24c24c27784e9cd00f061ebdcdc9b398e61eb4b17253260dde89089403761c580b205c92faaf60f782795a27e24ab90c735c5b2e9339ccc400844ab78f91741c42e9b7c38c30da37bdc8b3ac2dd4874d88b1401a89d094fc68bf3251d172d755851215171a4278fdce15de47ab40f86f16dfd92084274ee6a79dbb6491820489237774e201aae6bfb0d1d08149b9b92926a3a864c7d6c0aad0070f8db4cbac039f4feff2214717d1740de3b6e91df46a407b07fcb0c912f2a67896472bad7900c412a7882e60f8da57ab8800c77268b660b57185af1cf191acfdc7200f550ca0fad336bf9ea782e16493ce06615b239411f1960ee6fd5b702ab3351177899e5ce1be7d65a86bf8bc31836afb5f093f4477a3bf9fcc53e3c5ad5e4eeb8f90fdf32187b113cc64fcaeb7d2768095b9ea3c722d511e6d6d116318440000000fe0def24cf5c81316a64572746f1537a6a32c73820969c721dd422cce4b53a5e65ab11b6d1ec657c66c6a0bd56ae813f6ec75855d39e688a75d990e7d9b55b8f	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2712	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4760	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2712	4760	OpenWith.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\keylogger.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\keylogger.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads