5188c69bd772ebe6ca8b34e8c08eec90f63ffcf1d6ab20287e074732da21076a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 22:30

Target

jet.pyc
Size

43KB
MD5

26607351ccf2e9de1e035344be8dfcda
SHA1

5c38d2794b360b866fd3bd040ab033fd3007dff7
SHA256

def71c9a9d3ac683b7b7d22ba4d8658cd53a0521ee1ec17cecf7f66646c75192
SHA512

c5605bbb93e988a4f0aca6d7171bab2240c7f0f116c9e0290a45f40c5f2c387813ba4e40a5097cf913fcb7e30eeabbace261292b4184cfdf922fc43be9e6a78d
SSDEEP

768:jL5tse7c8cULSHrzJQRKc7Rr7R7O0AFzgN3FBcw2muyc:jlWUZ8rzJQR7Rr7R70KNpm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2740 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2740 AcroRd32.exe
2740 AcroRd32.exe

pid	process
2740	AcroRd32.exe

pid	process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1696	1668	cmd.exe	rundll32.exe
PID 1668 wrote to memory of 1696	1668	cmd.exe	rundll32.exe
PID 1668 wrote to memory of 1696	1668	cmd.exe	rundll32.exe
PID 1696 wrote to memory of 2740	1696	rundll32.exe	AcroRd32.exe
PID 1696 wrote to memory of 2740	1696	rundll32.exe	AcroRd32.exe
PID 1696 wrote to memory of 2740	1696	rundll32.exe	AcroRd32.exe
PID 1696 wrote to memory of 2740	1696	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\jet.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jet.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\jet.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b189b3f153c961fe8b88916cd7c363a8

SHA1
925a6b796d7ee3d3c5e25c99f245f495762410ff

SHA256
ab5700878ecca622c20c6e923275b7fad23f5875bbf03a801a7694d033c77fd5

SHA512
3dd153e5e0639aecfdfe8582c4eb7a817513e9768680185a95533343cf161c5230d8ba1ef21ad65905518374bc3f9097e162a3c165f30f82c6b7bf87af30089e

Download Submit