6ebb8752fca8db5f80fdcc3dda6dc4578df21307695cef2ad5a4dfcf2ae41c29

Analysis

max time kernel
1558s
max time network
1562s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 21:39

Target

main.pyc
Size

780B
MD5

2fbfde12483decdc73682a10ca637320
SHA1

64ccae484f68b327f7db49ed0b9cfcb3f2eb8a72
SHA256

240cc545cc806af78d647926c3b59bbf8aa72ef856e9607fee54a64f1e986855
SHA512

48c8d4b717d789cf6f289f34e4edd27f0ecc0e00892151ffdef90c5b8174b59c68555efcec975232cf22166633d8785d45d63220dcce3252c921aca518501dbd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2740 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2740 AcroRd32.exe
2740 AcroRd32.exe

pid	process
2740	AcroRd32.exe

pid	process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2524 wrote to memory of 2764	2524	cmd.exe	rundll32.exe
PID 2524 wrote to memory of 2764	2524	cmd.exe	rundll32.exe
PID 2524 wrote to memory of 2764	2524	cmd.exe	rundll32.exe
PID 2764 wrote to memory of 2740	2764	rundll32.exe	AcroRd32.exe
PID 2764 wrote to memory of 2740	2764	rundll32.exe	AcroRd32.exe
PID 2764 wrote to memory of 2740	2764	rundll32.exe	AcroRd32.exe
PID 2764 wrote to memory of 2740	2764	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f02307562303850e07a57c1bf5663d9

SHA1
33d275e4a98d43f2a423d25be90268b6466407bf

SHA256
2d1a7efbfb14f1c3ffa87db629fe71d50666a7ed888857f70310d2315ab74c43

SHA512
bc7bb275de187b75cbafb1df3fa33a28e1f8e829507222e94e8266d6455873e16a93bdcf4b52cd8e8b77ce0a1a55c1a3e337c4961bf3376dd5302da264379fa3

Download Submit