190aa963a6a8f6baf8454264cb86dda5a318d09c731be0e1bfe1275473ce8058

Analysis

max time kernel
152s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_weakrefset.pyc
Size

12KB
MD5

6d02bed2dae60aa228e41161a577670b
SHA1

69be1402efb3895f297ce092c5eaa97216f9cf9a
SHA256

00fc576c9c1b7e42ec1d16ce25ad7b8306be7a121c222bff42f329789542d9ae
SHA512

0bfe80d513882116d67076aa665989ec40e210e8dbdc429400b1ac68416b1872f53d7ee2ba0ec8f8a6702d0d5cee82205141e0b2e5a7a7c2f41a1f94bd00adc2
SSDEEP

192:i08ugM6eaK79jcnn4e19oNpVZacWjMEwjj0JJBXRqdTZEw:ipV1JY9gn4e19oNpLajjME8jgBITZEw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2896	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2896	AcroRd32.exe
2896	AcroRd32.exe
2896	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2724	1668	cmd.exe	29
PID 1668 wrote to memory of 2724	1668	cmd.exe	29
PID 1668 wrote to memory of 2724	1668	cmd.exe	29
PID 2724 wrote to memory of 2896	2724	rundll32.exe	30
PID 2724 wrote to memory of 2896	2724	rundll32.exe	30
PID 2724 wrote to memory of 2896	2724	rundll32.exe	30
PID 2724 wrote to memory of 2896	2724	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\_weakrefset.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6fa75486ac04f6777a32d83c142c0a2d

SHA1
feb69d3d6b127c846f213fa75798376ce289eb0b

SHA256
8a166617bb9f0c278dbce04dd8c4931a976c9c329296c3691fd7bcf50912aaf5

SHA512
d4e1f7e9c8c68112da1d0a64d8055c071a7b9cfeb9cca75d6ec5d0b4cd7fe2fb40b797377fdcd44da0051f8457dfeec6184308dcdf9f7aed8f0fdd19fb9f6bd9

Download Submit