74ac11fce440b7fd4458b9006f372f2cd17544fd741b75268a37d1edd278af04

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-05-2023 18:58

Target

pastebin.cpython-39.pyc
Size

937B
MD5

b409cf01d4580df9f130e3b7a7837945
SHA1

efe855fe5269bbeb0fbc90d3a1404849999d6377
SHA256

74ac11fce440b7fd4458b9006f372f2cd17544fd741b75268a37d1edd278af04
SHA512

b69626096d797c212d889ccd23ab6150269b984eba1d50421a2d2b9ff682bd2a92efe0487b21325495af5ea2cc78084bad229515b011ad53ee1be952d2ea6e89

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 828	2016	cmd.exe	29
PID 2016 wrote to memory of 828	2016	cmd.exe	29
PID 2016 wrote to memory of 828	2016	cmd.exe	29
PID 828 wrote to memory of 1436	828	rundll32.exe	30
PID 828 wrote to memory of 1436	828	rundll32.exe	30
PID 828 wrote to memory of 1436	828	rundll32.exe	30
PID 828 wrote to memory of 1436	828	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\pastebin.cpython-39.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\pastebin.cpython-39.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\pastebin.cpython-39.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1436

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact