a0039bc4ffc832bd5307f7d5e259b11c406b4d97e3c3ed8cff82fb0665cc5e6b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:05

Target

annoy.py
Size

3KB
MD5

2f776fabecf04f3e66ba60e02baef175
SHA1

dcc5e567d808a5549135cf4c15c7311277e401c3
SHA256

a0039bc4ffc832bd5307f7d5e259b11c406b4d97e3c3ed8cff82fb0665cc5e6b
SHA512

1110553d2d598a5fabbc15001d0801a909c4862742a0721ce1d66a7b925e5be09e1044ed8fb1e3a96d6a078d4b8d53a0c935ceabecbde3b28380a48f324171a7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2736 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2736 AcroRd32.exe
2736 AcroRd32.exe
2736 AcroRd32.exe

pid	process
2736	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2936 wrote to memory of 2032	2936	cmd.exe	rundll32.exe
PID 2936 wrote to memory of 2032	2936	cmd.exe	rundll32.exe
PID 2936 wrote to memory of 2032	2936	cmd.exe	rundll32.exe
PID 2032 wrote to memory of 2736	2032	rundll32.exe	AcroRd32.exe
PID 2032 wrote to memory of 2736	2032	rundll32.exe	AcroRd32.exe
PID 2032 wrote to memory of 2736	2032	rundll32.exe	AcroRd32.exe
PID 2032 wrote to memory of 2736	2032	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\annoy.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\annoy.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\annoy.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2736

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0e6511a1992f6e787665f84adadb7320

SHA1
8b63d8bbfb9a8c9771124272ce371d896fe9ce03

SHA256
71fb6b35f4b64bcd900cdeb569bae17d6437ee1a0af512097cdfce620bec984f

SHA512
008f875bf591f32e5e43c51358f9752271a9218b834b7df721f6acd134b023cc74c799210308407a48fd1be50b585ce8d7b1717abfcd4e03272bb047f144fa11

Download Submit