1e63cd9b656b3573f285dad69ff5836164d3c38642483030ba0666fd53fa4ea8

Analysis

max time kernel
190s
max time network
84s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GDHM_TASBOT_v33.15/.GDHM/tools/Geometrize2GD.py/main.py
Size

3KB
MD5

8639dda34c89465ec08656574207f213
SHA1

34e84e8511168b7235b9e94c0a7d5515aff28500
SHA256

644f4a6170892b8bb5cfa8779442dfded8273e050778243a7a054cef53aad639
SHA512

a8db085cf6c01d56f9f26a3df9e1a33118773d4c68e126b4fb69738f90ddb8b394d4386d06716306f2a0a977283087398cf5ef1e645ee44bdc364b8717060a52

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1516	AcroRd32.exe
1516	AcroRd32.exe
1516	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1444	1208	cmd.exe	29
PID 1208 wrote to memory of 1444	1208	cmd.exe	29
PID 1208 wrote to memory of 1444	1208	cmd.exe	29
PID 1444 wrote to memory of 1516	1444	rundll32.exe	31
PID 1444 wrote to memory of 1516	1444	rundll32.exe	31
PID 1444 wrote to memory of 1516	1444	rundll32.exe	31
PID 1444 wrote to memory of 1516	1444	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v33.15\.GDHM\tools\Geometrize2GD.py\main.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v33.15\.GDHM\tools\Geometrize2GD.py\main.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v33.15\.GDHM\tools\Geometrize2GD.py\main.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-54-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmp

Filesize
8KB

Download
memory/1516-82-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download