77fe5b92304d4c49361de1a1b4a86b12522271cfbe1cf76788fdcdaea869fc6d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18/06/2024, 10:44

Target
main.pyc
Size 236KB
Sample240618-mtb97sthjn
SHA256 1e061ffe496ec675fa32d8ac0d38fec6b6e66c3eeb3b58f82c56b8770a900172
MD5 f853afb6b40336ab956d29813fe9f711
SHA1 8fcf92815ea01ef373b8131b29b728be4ab348a3
SHA512 87ff932aca74953eaa24faaaa1f499faa9b6a074a3840333ad7330dcaa1c36d111ccf9ad1bac87678a325bc559ea99cd9abab25fa5d503b1dddcbeb308cb8f39
SSDEEP 6144:TkBHcTTTTTJTTTZ/hYNi/bSHP+UY5UB2FOPPxbZ4lds0g:T8cTTTTTJTTTZ//D2eOPJbZ4lds0g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1524	2420	cmd.exe	29
PID 2420 wrote to memory of 1524	2420	cmd.exe	29
PID 2420 wrote to memory of 1524	2420	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  PID:1524

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact