0b98e645f29f6ebf364734cb2545e4623800e0f420ea1324b37eb55742a9f731

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:01

Target

script.media.aggregator/context_search.py
Size

464B
MD5

55124731005cfb82179f4674c7074df5
SHA1

c5951f0e20a754a571d41dbe0db617b916c6fe39
SHA256

148826180c8d4aff55e846c31bfff85f7eb6e10e2f8a9e19aac2db04143dc6ae
SHA512

4fcd2f566403d37b4b64962fd1c99693a66e9bfa3bfd994c375b901de87de815e0e1971a135a36ad850e4efb2cb92b2c456105897816f731b78ab0d3f9fc833d

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2716 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2716 AcroRd32.exe
2716 AcroRd32.exe

pid	process
2716	AcroRd32.exe

pid	process
2716	AcroRd32.exe
2716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2600 wrote to memory of 2548	2600	cmd.exe	rundll32.exe
PID 2600 wrote to memory of 2548	2600	cmd.exe	rundll32.exe
PID 2600 wrote to memory of 2548	2600	cmd.exe	rundll32.exe
PID 2548 wrote to memory of 2716	2548	rundll32.exe	AcroRd32.exe
PID 2548 wrote to memory of 2716	2548	rundll32.exe	AcroRd32.exe
PID 2548 wrote to memory of 2716	2548	rundll32.exe	AcroRd32.exe
PID 2548 wrote to memory of 2716	2548	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\context_search.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\context_search.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\context_search.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2716

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a18c79c68dbc5c6930f0efc284817ed2

SHA1
532677a734e234e6e3f608e365044c954b8280f2

SHA256
0cbf081341654419ab358e1f9b30732c52f9a78bb43abbbac4e04426642d5950

SHA512
f8d9fcdf922fd58feb86407836066e83713835c20c20b6140f8064774978f791f050d92a600390fcc0b879e6c1b0d5d9ba895e121f4dd60cbcf3c06e8d0dc0d2

Download Submit