a617db081ad3b096a3c3255b06fb0b2eec1dfa570b06792be575f38c29199e90

Analysis

max time kernel
223s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:08

Target

sre_compile.pyc
Size

12KB
MD5

cdf07bd8aacf6881c2613920a544f505
SHA1

e870b38edb34959884edf8568fd17c06d62f32da
SHA256

26d72e06b83ecb5aa3cb7057a4bf821a91ab2d91365dca9bdcbc36eb2acb8926
SHA512

5c67a0aa61b75801514cdcb077012977ad56f01a4de9541c94f58e822b3b337a762bdb0e11a7c50c65739d817879e2b1a2900f07783431c85d4851aef686c400
SSDEEP

384:L3IMvxlGhOQ9cklzMaItdWLHmdYqrqsRh5+6:rTDDY6dYqrqQ+6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2528 AcroRd32.exe
2528 AcroRd32.exe
2528 AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2760 wrote to memory of 2680	2760	cmd.exe	rundll32.exe
PID 2760 wrote to memory of 2680	2760	cmd.exe	rundll32.exe
PID 2760 wrote to memory of 2680	2760	cmd.exe	rundll32.exe
PID 2680 wrote to memory of 2528	2680	rundll32.exe	AcroRd32.exe
PID 2680 wrote to memory of 2528	2680	rundll32.exe	AcroRd32.exe
PID 2680 wrote to memory of 2528	2680	rundll32.exe	AcroRd32.exe
PID 2680 wrote to memory of 2528	2680	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sre_compile.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\sre_compile.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sre_compile.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2528

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dae5b3f54fa1845e131272d399fcc432

SHA1
3a20ae69f2eb628ba977e6bd5cc864896c51c3bb

SHA256
cc415dccde71d1859d33907fe6a34d98843c2913790a22cb66b5fdab02791621

SHA512
5683a0a3ddce3f8f37b512b566de01d4c0af13e66c16c86a3bdd5df6a6acf8e8be304e7f99cf2837989dd51d4f34ded9a35535d1d88e7339180b8e5d4b1fed46

Download Submit