a617db081ad3b096a3c3255b06fb0b2eec1dfa570b06792be575f38c29199e90

Analysis

max time kernel
278s
max time network
319s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:08

Target

_weakrefset.pyc
Size

11KB
MD5

685d4aaf13a4f2bb43bec6340f853fa2
SHA1

2cbbad3829a7ecb101e1fe58e34b8651bc153389
SHA256

ac2dfa51d2edb55548f68ac15279b9e09944dda301478e2bb533e7948ed6187c
SHA512

76dcca6e3b7f93155bdbac2f5f94878b710de381c5732e64ef6432f7d709d111640868ea37d70400c4805cbf65289d18a88885f446cb7a25c110cecfa652b4d2
SSDEEP

192:s+2JxBMBSmGt2ob/rxBZ9qpa/awsHXqe11ZFKFbnaJ6My:Pofm5ojd9H/gHaoZQbgXy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2388 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2388 AcroRd32.exe
2388 AcroRd32.exe
2388 AcroRd32.exe

pid	process
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2760 wrote to memory of 2544	2760	cmd.exe	rundll32.exe
PID 2760 wrote to memory of 2544	2760	cmd.exe	rundll32.exe
PID 2760 wrote to memory of 2544	2760	cmd.exe	rundll32.exe
PID 2544 wrote to memory of 2388	2544	rundll32.exe	AcroRd32.exe
PID 2544 wrote to memory of 2388	2544	rundll32.exe	AcroRd32.exe
PID 2544 wrote to memory of 2388	2544	rundll32.exe	AcroRd32.exe
PID 2544 wrote to memory of 2388	2544	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2388

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6fbdbb02bc5ddd3bf3d25f336ff051e1

SHA1
81ae6b75fe50542e7779494e3eb5d3518dcb5265

SHA256
75d7c404f4adb4cde6a806a43208a7c8720e4ea2dbb74ba95047227ccf209017

SHA512
a92011d0d5383bbb8c8dfc786807a78c307a5456576cc5d15d5d939e3b246485ac1c93b5f0ac335c6b8b793f74449e2276da8f16ef32bff69e300f819455cc0d

Download Submit