8c53fc138ab93483314185026bec3ddc9e41aeb22ca1025a08f5b55238836f4c

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27-07-2023 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

logz.pyc
Size

43KB
MD5

e8404b29b4fa30815c7588269eba266e
SHA1

38a2bcd9687e1d8585d1d80220f1dc02502131ce
SHA256

f82ca3bffe904933b523c3a2e42866e66847e1636a22ecc12de839a20dfa982a
SHA512

72456fe0714beaf61f8f2f42c0fe509cef16b03b4cb81719c30f7e766d5312510ca9594e2b3984642f64b62a5b24d59f593e0baec5cf79375ab6c942fdb155e6
SSDEEP

768:moP7h/z2Q4JESUP/8L541CnVWhc6ceJ+wu0wkWtiPucunDLkgMQFkgLdXNzINMU:ms7h/z2oF8VSCV0cL6Ru07WQfunnRug0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2952	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2952	AcroRd32.exe
2952	AcroRd32.exe
2952	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2968	2468	cmd.exe	29
PID 2468 wrote to memory of 2968	2468	cmd.exe	29
PID 2468 wrote to memory of 2968	2468	cmd.exe	29
PID 2968 wrote to memory of 2952	2968	rundll32.exe	30
PID 2968 wrote to memory of 2952	2968	rundll32.exe	30
PID 2968 wrote to memory of 2952	2968	rundll32.exe	30
PID 2968 wrote to memory of 2952	2968	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\logz.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\logz.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\logz.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8328eab201c7e4d911ecb48ec35da1a0

SHA1
01d6205729fa124fff2b1712ce0dc5337bc3d9c5

SHA256
956287be77a74dc477ceaf48858a11e77456d730bcd3b592b956742da0ad0fe4

SHA512
2a4eb1731e9736e603fd3e77b7310b92c46d8f7a4eeaab7a98d0505407bf1403ebb9fc82e3c7bbb9e9cf6cdf8731afc434f0442c86e73247bc946189c4a6c7be

Download Submit