19857840331c8cc15dca34f5ad42c9d413cedfa307707d9c3764f2e7b43fc500

Analysis

max time kernel
160s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-11-2022 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Software Yuki/SoftwareDataDebug/examples/appium_example.py
Size

2KB
MD5

ea74819618a051e2536f122af645a599
SHA1

ebad572761ef4afd27f8f5f93f490836e57b8043
SHA256

a39c82e31d8fc14571cdb84ac06db6e27f338bfa5c6e7532e4bb1363391fc5cf
SHA512

44db269a386891df12e44a4f04c6312b0c996625692a15e3b961bbc5d7adaff2001718ba641b9b17d514495091a40bb47cf7a686cf4b188188d3601ea59079f9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

680 AcroRd32.exe
680 AcroRd32.exe
680 AcroRd32.exe

pid	process
680	AcroRd32.exe
680	AcroRd32.exe
680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1460 wrote to memory of 580	1460	cmd.exe	rundll32.exe
PID 1460 wrote to memory of 580	1460	cmd.exe	rundll32.exe
PID 1460 wrote to memory of 580	1460	cmd.exe	rundll32.exe
PID 580 wrote to memory of 680	580	rundll32.exe	AcroRd32.exe
PID 580 wrote to memory of 680	580	rundll32.exe	AcroRd32.exe
PID 580 wrote to memory of 680	580	rundll32.exe	AcroRd32.exe
PID 580 wrote to memory of 680	580	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Software Yuki\SoftwareDataDebug\examples\appium_example.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Software Yuki\SoftwareDataDebug\examples\appium_example.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:580

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Software Yuki\SoftwareDataDebug\examples\appium_example.py"
3⤵
- Suspicious use of SetWindowsHookEx
PID:680

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-76-0x0000000000000000-mapping.dmp

Download
memory/680-81-0x0000000000000000-mapping.dmp

Download
memory/680-82-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1460-54-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download