0b98e645f29f6ebf364734cb2545e4623800e0f420ea1324b37eb55742a9f731

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:01

Target

script.media.aggregator/backgrounds.py
Size

14KB
MD5

5100532cc0f372034dfbab0b5ee5539a
SHA1

918a8d30405c7279f0e516903af0449fadf51987
SHA256

1012f12f7325868844d6c13fe4c11bacc5e8cba64ecbf5c9c504952f36eb28bc
SHA512

2ccb94640548d5be33cd555503d37b25d6c039d9f0eb7996e78d701990097eeace735e15e4bd822e0b46c7a0f0d0603b2b389da26e5792044aa375abf18d6b2b
SSDEEP

192:RB8EDCXF8cC49PYO/fwc0lsv/1ctv38UaM32W+JmRPRR7Akd+PwblOmskeXBR5KQ:RBPDIEsvtcwItO6Ob5KdcSY0s

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2392 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2392 AcroRd32.exe
2392 AcroRd32.exe

pid	process
2392	AcroRd32.exe

pid	process
2392	AcroRd32.exe
2392	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2784 wrote to memory of 3060	2784	cmd.exe	rundll32.exe
PID 2784 wrote to memory of 3060	2784	cmd.exe	rundll32.exe
PID 2784 wrote to memory of 3060	2784	cmd.exe	rundll32.exe
PID 3060 wrote to memory of 2392	3060	rundll32.exe	AcroRd32.exe
PID 3060 wrote to memory of 2392	3060	rundll32.exe	AcroRd32.exe
PID 3060 wrote to memory of 2392	3060	rundll32.exe	AcroRd32.exe
PID 3060 wrote to memory of 2392	3060	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\backgrounds.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\backgrounds.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\backgrounds.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2392

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a06ba717acf7ddf23ec959d49f641187

SHA1
046b1b0dcab49968b3119853a4eb5b04983f5d51

SHA256
956310a4900f3c7dc26d7c915d8f88e5a63240b72867b4c951d29b8e14b17a6a

SHA512
14d4ac5d647e5862fb4890838b0aaf3a3abf566512812c58f34fa8cb0853f3882277c7cd6b955956b7cb2d5a225217a0a448e7f400e91b4880baeb7e64515819

Download Submit