e7d113ef928f0ce62a0accc0829da9720977c75427c4c901976e689c22c22a9f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 23:59

Target
dirt.pyc
Size 12KB
Sample240420-3147kade27
SHA256 22fbb24f3c24396cf4ed4efb11627516fdbc13f6c8f5e7949bf314d624c0a188
MD5 1e04b7019d4445a6fbad2f9b1f65b0cf
SHA1 625891d19b89425662f5c2461e362b80e5b1a380
SHA512 9fa72039350d52118a62312c142c13c1c55893ded77e5adf72474e1da4b276d844f08f5c0d93547ee42ce37c050ca0058287edec426ccd569dd261f90ee75e0a
SSDEEP 96:05ZwQ1gk5pYJnWuWHr1qbPW7MP2JMmHzJfzJU6W8KV3LB/6leQySy:05ZL1gnZWuKr1qbPz/HrFSy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2068	2180	cmd.exe	29
PID 2180 wrote to memory of 2068	2180	cmd.exe	29
PID 2180 wrote to memory of 2068	2180	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dirt.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\dirt.pyc
  2⤵
  - Modifies registry class
  PID:2068

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact