0b98e645f29f6ebf364734cb2545e4623800e0f420ea1324b37eb55742a9f731

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:01

Target

script.media.aggregator/context_show_similar.py
Size

1KB
MD5

0ab65d97948e75fe95504ed6fca49f52
SHA1

f3f30121637fc944acc98be48cc15214cd13ddde
SHA256

7dfa3272e22b5d4b60de04027dcc1deabc16232560a6e54b06e5577b59070376
SHA512

542292e9ca6636fcc6ed4adfd49f31e6468d2cf1e50ef0300a99c31402acbf579bad22226dea39c6f046080ba973a4494ec0b897c459f7dd24774690cd9ad4c3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2700 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2700 AcroRd32.exe
2700 AcroRd32.exe

pid	process
2700	AcroRd32.exe

pid	process
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1596 wrote to memory of 2996	1596	cmd.exe	rundll32.exe
PID 1596 wrote to memory of 2996	1596	cmd.exe	rundll32.exe
PID 1596 wrote to memory of 2996	1596	cmd.exe	rundll32.exe
PID 2996 wrote to memory of 2700	2996	rundll32.exe	AcroRd32.exe
PID 2996 wrote to memory of 2700	2996	rundll32.exe	AcroRd32.exe
PID 2996 wrote to memory of 2700	2996	rundll32.exe	AcroRd32.exe
PID 2996 wrote to memory of 2700	2996	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\context_show_similar.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\context_show_similar.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\context_show_similar.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2700

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dea2acf0d924c132b6bc004d0af7d890

SHA1
2bcc575b9ac4862c3b92ae6f8c55f9da93b474f2

SHA256
268c4406342fb3dab4651545174f46dc8e858ec54fc119326f2feb6b99a5c653

SHA512
814e13dc85d98641b2686f959be6ba94923d0a3fd93e4a07602b12028822810fef9f25880ba435dcdc7caff1a062a245490f966c62d0216678ad6812c0e1afe3

Download Submit