51e5b573b0a7be16eade5d17c2a40eb195cde9df56aaa623d8d94dc755798597

Analysis

max time kernel
155s
max time network
37s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/06/2023, 17:48

Target

urls.py
Size

367B
MD5

6561e22b2a136abc3f2965e1116dd745
SHA1

8a9a8d6c6cc8c4806683d4eaab0ed052b8d71ae2
SHA256

51e5b573b0a7be16eade5d17c2a40eb195cde9df56aaa623d8d94dc755798597
SHA512

73d73aa394a83c6b7650f121f2c134df6859db6884e5e932b220f88ca3c99d2ef503ee14fb679a3387e7d3f0a1168392b81e366bf068062c19ee807ad14f805e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
336	AcroRd32.exe
336	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2036	904	cmd.exe	28
PID 904 wrote to memory of 2036	904	cmd.exe	28
PID 904 wrote to memory of 2036	904	cmd.exe	28
PID 2036 wrote to memory of 336	2036	rundll32.exe	29
PID 2036 wrote to memory of 336	2036	rundll32.exe	29
PID 2036 wrote to memory of 336	2036	rundll32.exe	29
PID 2036 wrote to memory of 336	2036	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\urls.py
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\urls.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\urls.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact