Overview
overview
8Static
static
1disclaimer.bat
windows7-x64
1disclaimer.bat
windows10-2004-x64
1install req.bat
windows7-x64
1install req.bat
windows10-2004-x64
1main.py
windows7-x64
3main.py
windows10-2004-x64
3setup.bat
windows7-x64
1setup.bat
windows10-2004-x64
1start.bat
windows7-x64
1start.bat
windows10-2004-x64
1web/gui.html
windows7-x64
1web/gui.html
windows10-2004-x64
8web/index.js
windows7-x64
1web/index.js
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-03-2023 20:10
Static task
static1
Behavioral task
behavioral1
Sample
disclaimer.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
disclaimer.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
install req.bat
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
install req.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
main.py
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
main.py
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
setup.bat
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
setup.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral9
Sample
start.bat
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
start.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
web/gui.html
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
web/gui.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
web/index.js
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
web/index.js
Resource
win10v2004-20230220-en
General
-
Target
main.py
-
Size
15KB
-
MD5
ed4e86bf3dd9f31e190fb418b7552f11
-
SHA1
50a77749d4af0a2d49d9a6737abfd2b4435b80e5
-
SHA256
3fe44974b93aaeaed238552a19450200a084386795c1248d92c5daf94208da20
-
SHA512
ab38bbed356ce6f80e0b82b4ab22db8cf7479b80d1861eef2566367c641f4b4df9b80a2a8025f5b535810be3659509b4ce26d34d798230ba1aad6e3ee221a0db
-
SSDEEP
384:XNDTCbTCCTCcTCETCITCXTCATCCT8fETrT7T/TRTdUPAtUcwS7AsKup:dfKdl3l69dSonXrdObS7AsKup
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 1708 AcroRd32.exe 1708 AcroRd32.exe 1708 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 920 wrote to memory of 564 920 cmd.exe rundll32.exe PID 920 wrote to memory of 564 920 cmd.exe rundll32.exe PID 920 wrote to memory of 564 920 cmd.exe rundll32.exe PID 564 wrote to memory of 1708 564 rundll32.exe AcroRd32.exe PID 564 wrote to memory of 1708 564 rundll32.exe AcroRd32.exe PID 564 wrote to memory of 1708 564 rundll32.exe AcroRd32.exe PID 564 wrote to memory of 1708 564 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.py1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.py"3⤵
- Suspicious use of SetWindowsHookEx