f65dd14b1eca2993f985082dc29b8d9752e46f68196c5e68a98411c95f1a3360

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 08:50

Target
main.pyc
Size 14KB
Sample240616-krprea1dnn
SHA256 0b962efaa9eb3914c66257083433edaac951e26365d87431c0da2c67a180d1e2
MD5 25022f2c2e916f2edcefe11e9aa0c82c
SHA1 7b3ce22430c4f121789de5b2b05789173592f083
SHA512 f6e8bb09084441f85f73bdd3d1e5f7541de2da199316428188c05970581d79fafff32787115d598f3735fe8f7c5d481015a96fd806a06eb6a527350a385e687d
SSDEEP 192:+b+gORh6oMN9/x+G0wb3YRwbpChkcs4A4PQS3/CsD8VvJrc4jl0NMqN42+VxDEO7:kshTD34ChusDca4jl0qvSuj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2848	2264	cmd.exe	29
PID 2264 wrote to memory of 2848	2264	cmd.exe	29
PID 2264 wrote to memory of 2848	2264	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2848

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact