63b0a15d6e92441701d15f76576a8f93065d1ed8f40672dce8dfde7fc788ab12

Analysis

max time kernel
229s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 22:03

Target

_weakrefset.pyc
Size

11KB
MD5

685d4aaf13a4f2bb43bec6340f853fa2
SHA1

2cbbad3829a7ecb101e1fe58e34b8651bc153389
SHA256

ac2dfa51d2edb55548f68ac15279b9e09944dda301478e2bb533e7948ed6187c
SHA512

76dcca6e3b7f93155bdbac2f5f94878b710de381c5732e64ef6432f7d709d111640868ea37d70400c4805cbf65289d18a88885f446cb7a25c110cecfa652b4d2
SSDEEP

192:s+2JxBMBSmGt2ob/rxBZ9qpa/awsHXqe11ZFKFbnaJ6My:Pofm5ojd9H/gHaoZQbgXy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\pyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1824 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1824 AcroRd32.exe
1824 AcroRd32.exe
1824 AcroRd32.exe

pid	process
1824	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2852 wrote to memory of 2736	2852	cmd.exe	rundll32.exe
PID 2852 wrote to memory of 2736	2852	cmd.exe	rundll32.exe
PID 2852 wrote to memory of 2736	2852	cmd.exe	rundll32.exe
PID 2736 wrote to memory of 1824	2736	rundll32.exe	AcroRd32.exe
PID 2736 wrote to memory of 1824	2736	rundll32.exe	AcroRd32.exe
PID 2736 wrote to memory of 1824	2736	rundll32.exe	AcroRd32.exe
PID 2736 wrote to memory of 1824	2736	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1824

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c6fd61d10f2cf1ccb467cd74da97b859

SHA1
5eb0480cd1dd9ca63a1168e81a4ed3529bf60cfb

SHA256
7abef3ebf877fb62630b363ad0fecf2d23046ab93b8f72be77405b9c7c529fe5

SHA512
6d3100363166ac9b0a3ecc2ac49f062623c7d888cdf5e8ee1549decd700c6de1d09e1923398aa5747802195f7301507d1a010ec2cfc7b45869d951e8639e016a

Download Submit