deac181d9f369808808e3aff6effa4d8baa128c5408091ad771c0aa84159ef28

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 15:31

Target

main.pyc
Size

8KB
MD5

cd633dce5faa97109af5d8a3dca9955c
SHA1

6314e39a44476d6f14e30f0df754f267f0dff0e4
SHA256

2d687bcadc0eedac7092064afd0ff688a2661e06b9adcca45ec08242a6fb33d3
SHA512

6a149d9fe8e9ef8f7cd9c0e9396a12d86c4afb730a24c0420ab20dd036eee9d5128099df5571fb8b8793326d347ce0be873f642ff60f1c9b79f9adbe634345c8
SSDEEP

192:056eGBI1UnZDHxUUkkkpEisy6Cdaw24ky6E10Q1VbdDWDZ3xvZeMJB/4i:056e7SnZD1UwCsUkyD10CtdDWDdxheMb

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2812 AcroRd32.exe
2812 AcroRd32.exe

pid	process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 2560	2100	cmd.exe	rundll32.exe
PID 2100 wrote to memory of 2560	2100	cmd.exe	rundll32.exe
PID 2100 wrote to memory of 2560	2100	cmd.exe	rundll32.exe
PID 2560 wrote to memory of 2812	2560	rundll32.exe	AcroRd32.exe
PID 2560 wrote to memory of 2812	2560	rundll32.exe	AcroRd32.exe
PID 2560 wrote to memory of 2812	2560	rundll32.exe	AcroRd32.exe
PID 2560 wrote to memory of 2812	2560	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
3⤵
- Suspicious use of SetWindowsHookEx
PID:2812

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e9bb3ebaef64bd5e943291af14f42f1c

SHA1
3f442a2fff94df6e0214b18d0d788126c7a78a4c

SHA256
bb438a3cfa192a47fde8487386795004a87bf74c4bfed0b2f6b2ae8eda13b19a

SHA512
d81aebc537705199bc513a222a24031ec53ed4986adf4d04f8a4d746acfda6cb9d90eac1c7c9105f6a821ff9a979f73beff8235459cc1d1882ef6582ffb87055

Download Submit