24de2b71477635f2bdb96e6990ed37de9cb8848dd29210ffe8ddd1d0ec948734

Analysis

max time kernel
151s
max time network
62s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CVE-2014-6352.py
Size

22KB
MD5

03e4b8cb40edf5b73bc381f9391162dc
SHA1

b886c6550510c9b83bc6630f6c3493ec05e85fd1
SHA256

843c67233c84ade4b7188185379c3f68f5ef07090602a6fce41747fca7e10cdf
SHA512

2a4abb5c80992155c331c6a656c28672707020562bd330a234feb04ac5041660c81f5da34394e93d390f27bc05722e4d59d9df2fded4e23566fec00faaea74fe
SSDEEP

192:q4f7212OUSqaxzomyoSNPThTSND6knxi7ElS/m5GK7:q4z212nmorFhVE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

436 AcroRd32.exe
436 AcroRd32.exe
436 AcroRd32.exe

pid	process
436	AcroRd32.exe
436	AcroRd32.exe
436	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1760	2028	cmd.exe	rundll32.exe
PID 2028 wrote to memory of 1760	2028	cmd.exe	rundll32.exe
PID 2028 wrote to memory of 1760	2028	cmd.exe	rundll32.exe
PID 1760 wrote to memory of 436	1760	rundll32.exe	AcroRd32.exe
PID 1760 wrote to memory of 436	1760	rundll32.exe	AcroRd32.exe
PID 1760 wrote to memory of 436	1760	rundll32.exe	AcroRd32.exe
PID 1760 wrote to memory of 436	1760	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2014-6352.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CVE-2014-6352.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1760

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CVE-2014-6352.py"
3⤵
- Suspicious use of SetWindowsHookEx
PID:436

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-81-0x0000000000000000-mapping.dmp

Download
memory/436-82-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/1760-76-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download