3d668ae44d21f18c8b8eaa80a1421ccbae3922d7a904176f8be30a5be0cdef9e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 07:16

Target

$TEMP/ubi-console-setup.cpython-36.pyc
Size

21KB
MD5

598ca3a5509a1362bb29a4af0577b964
SHA1

6f73a6575550dbb85d7e15e3528cb1919690431f
SHA256

08b9dc7de2a3c8864079570f1aa766737e8c410c7f60cee6157d127189391cce
SHA512

5aeece830ec39512144f265fc91bdb1f83efc9a565f3d21921b74e1543137adf6fac060ce19ba722fddbc5a009a7cc1380bded701202e3890734d14686f608d3
SSDEEP

384:PS4WSi3bMeIvKgBJ8ZDMK4icWPetLJchVU8qiQOPxquoCXSXrj2+Km:PeS6YezJA9icWPqchVUyXS7Xl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2800 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2800 AcroRd32.exe
2800 AcroRd32.exe

pid	process
2800	AcroRd32.exe

pid	process
2800	AcroRd32.exe
2800	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2676 wrote to memory of 2556	2676	cmd.exe	rundll32.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	rundll32.exe
PID 2676 wrote to memory of 2556	2676	cmd.exe	rundll32.exe
PID 2556 wrote to memory of 2800	2556	rundll32.exe	AcroRd32.exe
PID 2556 wrote to memory of 2800	2556	rundll32.exe	AcroRd32.exe
PID 2556 wrote to memory of 2800	2556	rundll32.exe	AcroRd32.exe
PID 2556 wrote to memory of 2800	2556	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$TEMP\ubi-console-setup.cpython-36.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$TEMP\ubi-console-setup.cpython-36.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\ubi-console-setup.cpython-36.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2800

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0975aee666172e9c7d11a08cc7b48b4c

SHA1
3f2a1f72d0ada466fcf09c16f9ee69fe23cb76b0

SHA256
c6475c91d5ce86ee44282a617c9a5a5eaa40d2eafb4eaa07b1f2433c28e27120

SHA512
164dcbc9716330c6b5562331c90644c6afa67db95cc28723e52e5e80fec47d7136825d8236980bb7f5d68b4a0fa2a0bcc1b8946a3a2e5f979845c679fe04b933

Download Submit