e8814613f75dddf103686ebd40bfbfde74bf4829c9a1b103ef13175c5c99e84c

Resubmissions

05/08/2023, 21:39

230805-1h3vnsgc41 3

05/08/2023, 21:37

230805-1gplnagc4z 7

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

obfuscated_FreeRubuxAndvBuxsNotVirusForReal.pyc
Size

122KB
MD5

5b3b6e7feb10be4eba3355fdcb91cad2
SHA1

7dbbeee47031a23ca4ad8e096ee49c28fd3a98fc
SHA256

78181c10f92da139972822a3466d1f21e3990031eca424cb99038e98e448203b
SHA512

54ce137bb6ec92507090f6a4316ab2764c4a768a79f98cd6d2b0ee7cb12089ea8993dc830bcad790f7cbebfeaf6be2d7bb79843bd97aa6ddb465219ea06da24e
SSDEEP

3072:RW5WvKde565IX+uynZIGjbsR2pCPirkK2cUffz6LF0:c6oZyX+uEsR2Vr2VT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2220	2044	cmd.exe	29
PID 2044 wrote to memory of 2220	2044	cmd.exe	29
PID 2044 wrote to memory of 2220	2044	cmd.exe	29
PID 2220 wrote to memory of 2648	2220	rundll32.exe	30
PID 2220 wrote to memory of 2648	2220	rundll32.exe	30
PID 2220 wrote to memory of 2648	2220	rundll32.exe	30
PID 2220 wrote to memory of 2648	2220	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\obfuscated_FreeRubuxAndvBuxsNotVirusForReal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\obfuscated_FreeRubuxAndvBuxsNotVirusForReal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\obfuscated_FreeRubuxAndvBuxsNotVirusForReal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e0d450aebff34f9e77a242d714f777f0

SHA1
ea9712cd73c243b3dfd4a9a470bc48499171fa1c

SHA256
9d463d16c08a4979372a1a181bb98ee2da80f2640fe2de566b67b951272dc7c5

SHA512
22bd84e4989f95c9953c808c9e823dbce97b989a9aea33bdaea812676450b82000795a6a28f8e6d8cb04e4b5f3d4e7d3bd6f90704ed1f048b576909736011edf

Download Submit