ce0f6dd48d1d07a23e03b616f30e0aada3a484cc13e2bb85f609a9fceb144b6c

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 10:59

Target

ysrfgdyjkfgydg.pyc
Size

123B
MD5

9b5f68d1f895e135843a4a2227e77aaf
SHA1

f544aa5bd1d57a62be735b189588ed1297ca680f
SHA256

ce0f6dd48d1d07a23e03b616f30e0aada3a484cc13e2bb85f609a9fceb144b6c
SHA512

48498842be48bc3849bf298363c1d00c601776c81b0db30158134fae6364399612a95027562bb12a1253802d86ae69494c93b552d683c30241e95f148b35674e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2840	2804	cmd.exe	31
PID 2804 wrote to memory of 2840	2804	cmd.exe	31
PID 2804 wrote to memory of 2840	2804	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ysrfgdyjkfgydg.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ysrfgdyjkfgydg.pyc
  2⤵
  - Modifies registry class
  PID:2840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact