912760fd67c9a6feed26ef7069e26cf69d603329610cfc255cc1cad160261105

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

linux/gevent/baseserver.py
Size

11KB
MD5

573685fb044a672c4a27d1240ad89527
SHA1

2aaafdef3469648e6028b4c5cdd82c502439d6e5
SHA256

033e254af14afe6207f71b310ad5ad77ac36644d7658c576ddceaab0afddaf92
SHA512

d873a1861a7b740c38953a77f6d7f1a10d1f657902a9dd5a122f1e56af0408244977c49766f5080103afd569fe7c55830d5839cf47fac08b9b266acfd5e67d12
SSDEEP

192:8moIfbyhyax5AMv1XRgqmE7rZUwRG3RE2aUG2z+5kNRnlFnIiVm:8ZCbW1JV6ykTnlFnIiVm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1020 AcroRd32.exe
1020 AcroRd32.exe
1020 AcroRd32.exe

pid	process
1020	AcroRd32.exe
1020	AcroRd32.exe
1020	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1372 wrote to memory of 1968	1372	cmd.exe	rundll32.exe
PID 1372 wrote to memory of 1968	1372	cmd.exe	rundll32.exe
PID 1372 wrote to memory of 1968	1372	cmd.exe	rundll32.exe
PID 1968 wrote to memory of 1020	1968	rundll32.exe	AcroRd32.exe
PID 1968 wrote to memory of 1020	1968	rundll32.exe	AcroRd32.exe
PID 1968 wrote to memory of 1020	1968	rundll32.exe	AcroRd32.exe
PID 1968 wrote to memory of 1020	1968	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\linux\gevent\baseserver.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\linux\gevent\baseserver.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\linux\gevent\baseserver.py"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1020

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-81-0x0000000000000000-mapping.dmp

Download
memory/1020-82-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1372-54-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download
memory/1968-76-0x0000000000000000-mapping.dmp

Download