1dd9011c7f2faccae6b075e26c6c63977ef29ae1b761e6ba0a2479dc8a3de01e

Analysis

max time kernel
36s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

29KB
MD5

6a99bfecfca3d302c5e84fcffc17c2cb
SHA1

e5ba4fbec7b12250114283f59f3ec6f63fcb6541
SHA256

9c63041462f5807702cf3db884ae1e45f76a3ee9ed601439734f1864a0ac47d2
SHA512

3a51941b73893a1d69f5897cc4a61ed8f74b51a304ec5286daa713cd842c225849d85f97b5f504a101e1446af982de6e1fbe7e1433697b17b57596adb8274b5f
SSDEEP

768:pivl0d5jYDAlk+qA+GPiNq2V7OpIVFRvHr2phHPU+ImEKQlw7cC8kHC:kexjiqgSyVPVmVQlRii

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
848	AcroRd32.exe
848	AcroRd32.exe
848	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1480	2076	cmd.exe	29
PID 2076 wrote to memory of 1480	2076	cmd.exe	29
PID 2076 wrote to memory of 1480	2076	cmd.exe	29
PID 1480 wrote to memory of 848	1480	rundll32.exe	30
PID 1480 wrote to memory of 848	1480	rundll32.exe	30
PID 1480 wrote to memory of 848	1480	rundll32.exe	30
PID 1480 wrote to memory of 848	1480	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ba824eeb094a502573063d6399cfda9c

SHA1
9fe3c480a2dfa4a56292051dba5ba31eb876429f

SHA256
8b83586ff9ec13d249ca854841299f50385a1011a057a02e3a4726dda6cc7dc0

SHA512
2c45a45d31753e25566f1be7ab2848fdf3b6d9b4d03d71ea512d567ca9072cf93a44b23458b3fbe982fcac7220ae32e169c04f803421b0f69a91baa290afb525

Download Submit