8c2a7ddd3df7bf22b0e8d38ad9497b6e2d2eacf820316f5185663bdc73106b8e

Analysis

max time kernel
153s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AMON-Eye/C2-Profiles/concealer/C2concealer/data/transform.py
Size

316B
MD5

1a6a1655b55010deeef7044c802eb11c
SHA1

42fd88a8d356e8be076181ad1ae10b9b0e231acf
SHA256

73608dd176e3eca70e499f2828f99ff67112230b796bbb67fc285b9f522aa573
SHA512

6eee96410cd9aa170f889f9bef87394e8131511e7ccf03626458fad4a3eb8f8fa3d0e76373957171eda0029376882a44dd5fc0f0eb9f41c85d1607d50e5c6ba0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1112 AcroRd32.exe
1112 AcroRd32.exe
1112 AcroRd32.exe

pid	process
1112	AcroRd32.exe
1112	AcroRd32.exe
1112	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 904 wrote to memory of 1952	904	cmd.exe	rundll32.exe
PID 904 wrote to memory of 1952	904	cmd.exe	rundll32.exe
PID 904 wrote to memory of 1952	904	cmd.exe	rundll32.exe
PID 1952 wrote to memory of 1112	1952	rundll32.exe	AcroRd32.exe
PID 1952 wrote to memory of 1112	1952	rundll32.exe	AcroRd32.exe
PID 1952 wrote to memory of 1112	1952	rundll32.exe	AcroRd32.exe
PID 1952 wrote to memory of 1112	1952	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AMON-Eye\C2-Profiles\concealer\C2concealer\data\transform.py
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AMON-Eye\C2-Profiles\concealer\C2concealer\data\transform.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AMON-Eye\C2-Profiles\concealer\C2concealer\data\transform.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads